aswin1906/github-advisory-2023 huggingface dataset:
Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction (GHSA-34hj-v8fm-x887)
Aliases: CVE-2023-38708
Published: 2023-08-03T16:33:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.6.7'}]}]}]

### Impact
A path traversal vulnerability exists in the `AssetController::importServerFilesAction`, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite.

The impact of this vulnerability allows attackers to:

Overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information.

Tamper with system settings by modifying key files, such as the hosts file in Windows or configuration files for other services.

Cause a denial of service (DoS) if critical system files are overwritten or deleted.

The consequences of exploiting this vulnerability can be detrimental to the confidentiality, integrity, and availability of the affected system. It's crucial to address this vulnerability to protect sensitive data and ensure the proper functioning of the system.

### Patches
Update to version 10.6.7 or apply this patch manually https://github.com/pimcore/pimcore/commit/58012d0e3b8b926fb54eccbd64ec5c993b30c22c.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/58012d0e3b8b926fb54eccbd64ec5c993b30c22c.patch manually.
underscore-keypath vulnerable to Prototype Pollution (GHSA-gpvc-mx6g-cchv)
Aliases: CVE-2023-26139
Published: 2023-08-01T06:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'underscore-keypath'}, 'ecosystem_specific': {'affected_functions': ['underscore-keypath.setValueForKeyPath']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.11'}, {'last_affected': '0.9.3'}]}]}]

Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the `setProperty()` function. Exploiting this vulnerability is possible due to improper input sanitization which allows the usage of arguments like `__proto__`.
ThinkCMF Cross-site Scripting Vulnerability (GHSA-4847-gqxx-v9xp)
Aliases: CVE-2020-25915
Published: 2023-08-11T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thinkcmf/thinkcmf'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.1.7'}]}]}]

Cross Site Scripting (XSS) vulnerability in `UserController.php` in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted `user_login`.
Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading (GHSA-xvhg-w6qc-m3qq)
Aliases: CVE-2023-40023
Published: 2023-08-15T20:08:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/yaklang/yaklang'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.4-sp2'}]}]}]

### Impact

The Yak Engine has been found to contain a local file inclusion (LFI) vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to the unintended exposure of sensitive data, potential remote code execution, or other security breaches. Users utilizing versions of the Yak Engine prior to 1.2.4-sp1 are impacted.

### Patches

The vulnerability has been addressed and patched. Users are advised to upgrade to Yak Engine version 1.2.4-sp1 immediately. The patch can be viewed and reviewed at this PR: [https://github.com/yaklang/yaklang/pull/295](https://github.com/yaklang/yaklang/pull/295)，[https://github.com/yaklang/yaklang/pull/296](https://github.com/yaklang/yaklang/pull/296)

### Workarounds

Currently, the most effective solution is to upgrade to the patched version of Yak Engine (1.2.4-sp1). Users are also advised to avoid exposing vulnerable versions to untrusted input and to closely monitor any unexpected server behavior until they can upgrade.

### References

For more details on the vulnerability and the corresponding patch, please visit the following link:
- [PR addressing the LFI vulnerability in Yak Engine](https://github.com/yaklang/yaklang/pull/295)
- [disable default file fuzztag in fuzz.Pool](https://github.com/yaklang/yaklang/pull/296)
- [利用yakit功能特性溯源攻击者](https://mp.weixin.qq.com/s?__biz=Mzg5ODE3NTU1OQ==&mid=2247484236&idx=1&sn=ef0c14a89721800b2311d0e487388399)
lol-html panics on certain HTML inputs (GHSA-c3x7-354f-4p2x)
Aliases: CVE-2023-4241
Published: 2023-08-09T13:17:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'lol-html'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.1'}]}]}]

### Impact
lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.

### Patches
The problem has been patched and released as v1.1.1

### Workarounds
No workarounds exist.
Command injection in pagekit (GHSA-j6mp-hx4g-p3gm)
Aliases: CVE-2023-41005
Published: 2023-08-29T00:32:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pagekit/pagekit'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.18'}]}]}]

An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in UpdateController.php
Vyper has incorrectly allocated named re-entrancy locks (GHSA-5824-cm3x-3c38)
Aliases: CVE-2023-39363
Published: 2023-08-09T14:27:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vyper'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.2.15'}, {'fixed': '0.3.1'}]}]}]

### Impact

In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically:

- A `.vy` contract compiled with either of the following `vyper` versions: `0.2.15`, `0.2.16`, `0.3.0`
- A primary function that utilizes the `@nonreentrant` decorator with a specific `key` and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates)
- A secondary function that utilizes the same `key` and would be affected by the improper state caused by the primary function

### Patches
https://github.com/vyperlang/vyper/pull/2439, https://github.com/vyperlang/vyper/pull/2514

### Workarounds
Upgrade to 0.3.1 or higher

### References
Technical post-mortem report: https://hackmd.io/@vyperlang/HJUgNMhs2
lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files (GHSA-9phh-r37v-34wh)
Published: 2023-08-14T21:10:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/treeverse/lakefs'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.106.0'}]}]}]

### Impact
The browser renders the resulting HTML when opening a direct link to an HTML file via lakeFS. Any JavaScript within that page is executed within the context of the domain lakeFS is running in.  
An attacker can inject a malicious script inline, download resources from another domain, or make arbitrary HTTP requests. This would allow the attacker to send information to a random domain or carry out lakeFS operations while impersonating the victim.  

Note that to carry out this attack, an attacker must already have access to upload the malicious HTML file to one or more repositories. It also depends on the victim receiving and opening the link to the malicious HTML file.

### Patches
This is fixed in lakeFS version 0.106.0

### Workarounds
There are no known workarounds at this time.
Sandbox escape via various forms of "format". (GHSA-xjw2-6jm9-rf67)
Aliases: CVE-2023-41039
Published: 2023-08-30T20:47:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'RestrictedPython'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.3'}}, {'package': {'ecosystem': 'PyPI', 'name': 'RestrictedPython'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0'}, {'fixed': '6.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.1'}}]

### Impact
Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure.
With `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`.
All known versions of `RestrictedPython` are vulnerable. 

### Patches
The issue will be fixed in 5.4 and 6.2.

### Workarounds
There are no workarounds to fix the issue without upgrading.

### References
* https://docs.python.org/3/library/stdtypes.html#str.format_map
* http://lucumr.pocoo.org/2016/12/29/careful-with-str-format/
* https://www.exploit-db.com/exploits/51580

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [RestrictedPython issue tracker](https://github.com/zopefoundation/RestrictedPython/issues)
* Email us at [security@plone.org](mailto:security@plone.org)

### Credits

Thanks for analysing and reporting the go to:

* Abhishek Govindarasu
* Ankush Menat
* Ward Theunisse
cross-site inclusion (XSSI) of files in jupyter-server (GHSA-64x5-55rw-9974)
Aliases: CVE-2023-40170
Published: 2023-08-29T23:34:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'jupyter-server'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.7.2'}]}]}]

### Impact

Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via  "Open image in new tab".

### Patches

Jupyter Server 2.7.2

### Workarounds

Use lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.

### References

Upstream patch for CVE-2019-9644 was not applied completely, leaving part of the vulnerability open.

Vulnerability reported by Tim Coen via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).
Unsanitized user controlled input in module generation (GHSA-f8pq-3926-8gx5)
Published: 2023-08-09T20:59:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': '@opentelemetry/instrumentation'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.40.0'}, {'fixed': '0.41.2'}]}]}]

## Impact

The `import-in-the-middle` loader used by `@opentelemetry/instrumentation` works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. It allows for remote code execution in cases where an application passes user-supplied input directly to an `import()` function.

## Patches

This vulnerability has been patched in `@opentelemetry/instrumentation` version `0.41.2`

## Workarounds

- Do not pass any user-supplied input to `import()`. Instead, verify it against a set of allowed values.
- If using `@opentelemetry/instrumentation` with support for EcmaScript Modules is not needed, ensure that none of the following options are set (either via command-line or the `NODE_OPTIONS` environment variable):
```
--experimental-loader=@opentelemetry/instrumentation/hook.mjs
--experimental-loader @opentelemetry/instrumentation/hook.mjs
--loader=import-in-the-middle/hook.mjs
--loader import-in-the-middle/hook.mjs
```

## References

- https://github.com/DataDog/import-in-the-middle/security/advisories/GHSA-5r27-rw8r-7967
PrestaShop SQL manager vulnerability (GHSA-gf46-prm4-56pc)
Aliases: CVE-2023-39526
Published: 2023-08-09T14:36:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.1.0'}, {'fixed': '8.1.1'}]}], 'versions': ['8.1.0']}, {'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.0.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.8.10'}]}]}]

### Impact
Remote code execution through SQL injection and arbitrary file write in back office

### Patches
1.7.8.10
8.0.5
8.1.1

### Found by
Truff (via yeswehack)

### Workarounds
none

### References
none
1Panel arbitrary file write vulnerability (GHSA-hf7j-xj3w-87g4)
Aliases: CVE-2023-39966
Published: 2023-08-10T20:09:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/1Panel-dev/1Panel'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.3'}, {'fixed': '1.5.0'}]}], 'versions': ['1.4.3']}]

# Summary
An arbitrary file write vulnerability could lead to direct control of the server
# Details
## Arbitrary file creation
In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this:

- Vulnerable Code

![微信图片_20230801092544](https://user-images.githubusercontent.com/136411443/257381095-4d7c014b-b699-4152-8b9d-2cc9399dfd85.png)

# PoC

- We can write the SSH public key into the /etc/.root/authorized_keys configuration file on the server.

![微信图片_20230801093243](https://user-images.githubusercontent.com/136411443/257381907-38784fab-77b9-47b9-a598-44ef7ad0b65c.png)

- The server was successfully written to the public key
![微信图片_20230801093610](https://user-images.githubusercontent.com/136411443/257382468-b4836eee-f751-4b43-93ff-cb39fdc6c809.png)

- Successfully connected to the target server using an SSH private key.
![微信图片_20230801093933](https://user-images.githubusercontent.com/136411443/257383031-53f1e5de-2743-48ed-a1cf-9a5ea0c0f90b.png)
![微信图片_20230801094037](https://user-images.githubusercontent.com/136411443/257383041-d9f64647-95d9-4711-8b9f-e152966537c9.png)

As a result, the server is directly controlled, causing serious **harm**


# Impact
1Panel v1.4.3
Code injection in ansible semaphore (GHSA-3r32-cp7v-5wq4)
Aliases: CVE-2023-39059
Published: 2023-08-29T00:32:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/ansible-semaphore/semaphore'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.8.90'}]}]}]

An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter.
SpringBlade vulnerable to SQL injection (GHSA-62pr-54gv-vg5g)
Aliases: CVE-2023-40787
Published: 2023-08-29T15:31:51Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springblade:blade-core-tool'}, 'ecosystem_specific': {'affected_functions': ['']}, 'versions': ['3.6.0']}]

In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.
Blind local file inclusion (GHSA-cwvm-v4w8-q58c)
Aliases: CVE-2023-41040
Published: 2023-08-30T20:09:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'GitPython'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.35'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.1.34'}}]

### Summary

In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system.

### Details

This vulnerability is present in

https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175

That code joins the base directory with a user given string without checking if the final path is located outside the base directory.

I was able to exploit it from three places, but there may be more code paths that lead to it:

https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/repo/base.py#L605

https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/repo/base.py#L620

https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/index/base.py#L1353

### PoC

Running GitPython within any repo should work, here is an example with the GitPython repo.

```python
import git

r = git.Repo(".")

# This will make GitPython read the README.md file from the root of the repo
r.commit("../README.md")
r.tree("../README.md")
r.index.diff("../README.md")

# Reading /etc/random
# WARNING: this will probably halt your system, run with caution
# r.commit("../../../../../../../../../dev/random")
```

### Impact

I wasn't able to show the contents of the files (that's why "blind" local file inclusion), depending on how GitPython is being used, this can be used by an attacker for something _inoffensive_ as checking if a file exits, or cause a DoS by making GitPython read a big/infinite file (like `/dev/random` on Linux systems).

### Possible solutions

A solution would be to check that the final path isn't located outside the `repodir` path (maybe even after resolving symlinks). Maybe there could be other checks in place to make sure that the reference names are valid.

---

> [!NOTE]
> This vulnerability was reported via email, and it was decided to publish it here and make it public, so the community is aware of it, and a fix can be provided.
SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE (GHSA-jxcx-3h54-qqxx)
Published: 2023-08-23T19:43:56Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'silverstripe/admin'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.13.6'}]}]}]

TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin.

Only Silverstripe CMS 4 is affected by these vulnerabilities. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin.

Silverstripe CMS 5 is not affected by these vulnerabilities because it uses TinyMCE 6.
matrix-appservice-irc IRC command injection via admin commands containing newlines  (GHSA-3pmj-jqqp-2mj3)
Aliases: CVE-2023-38690
Published: 2023-08-04T17:26:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'matrix-appservice-irc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.0.0'}}]

### Impact

It is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. 

### Patches

Versions 1.0.1 and above are patched.

### Workarounds

There are no robust workarounds to the bug. You can disable dynamic channels in the config to disable the most common execution method but others may exist. It is highly recommended to upgrade the bridge.

### Credits

Discovered and reported by [Val Lorentz](https://valentin-lorentz.fr/).

### For more information

If you have any questions or comments about this advisory email us at [security@matrix.org](mailto:security@matrix.org).
Mattermost fails to check if user is a guest before performing actions on public playbooks (GHSA-p267-jjfq-pphf)
Aliases: CVE-2023-4106
Published: 2023-08-11T09:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.9.0'}, {'fixed': '7.9.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.9.5'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.10.0'}, {'fixed': '7.10.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.10.3'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.8.8'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.8.7'}}]

Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.
Gila CMS Cross-site Scripting Vulnerability (GHSA-rvjp-j5j4-c9j5)
Aliases: CVE-2020-20523
Published: 2023-08-11T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'gilacms/gila'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.11.3'}}]

Cross Site Scripting (XSS) vulnerability in `adm_user` parameter in Gila CMS version 1.11.3, allows remote attackers to execute arbitrary code during the Gila CMS installation.
Jenkins Tuleap Authentication Plugin non-constant time token comparison (GHSA-5r33-mgjf-6656)
Aliases: CVE-2023-40343
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:tuleap-oauth'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.21'}]}]}]

Jenkins Tuleap Authentication Plugin 1.1.20 and earlier does not use a constant-time comparison when checking whether two authentication tokens are equal.

This could potentially allow attackers to use statistical methods to obtain a valid authentication token.

Tuleap Authentication Plugin 1.1.21 uses a constant-time comparison when validating authentication tokens.
tree-kit Prototype Pollution vulnerability (GHSA-5p42-m6f3-hpmj)
Aliases: CVE-2023-38894
Published: 2023-08-17T00:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'tree-kit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.7.5'}]}]}]

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.
matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs (GHSA-vc7j-h8xg-fv5x)
Aliases: CVE-2023-38691
Published: 2023-08-04T17:26:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'matrix-appservice-bridge'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '8.1.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'matrix-appservice-bridge'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '9.0.1'}]}], 'versions': ['9.0.0']}]

### Impact

A malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API.

### Details

The library does not check that the servername part of the `sub` parameter (containing the user's *claimed* MXID) is the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a `sub` parameter according to the user they want to act as and use the resulting token to perform provisioning requests.

### Workarounds

Disable the provisioning API. If the bridge does not use the provisioning API, you are not vulnerable.
json2xml Uncaught Exception vulnerability (GHSA-8rj5-2857-877j)
Aliases: CVE-2022-25024
Published: 2023-08-23T13:19:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'json2xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.14.0'}]}]}]

The json2xml package for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.
Command Injection Vulnerability in find-exec (GHSA-95rp-6gqp-6622)
Aliases: CVE-2023-40582
Published: 2023-08-30T20:08:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'find-exec'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.3'}]}]}]

Older versions of the package are vulnerable to Command Injection as an attacker controlled parameter. As a result, attackers may run malicious commands.

For example:

```
const find = require("find-exec");
find("mplayer; touch hacked")
```

This creates a file named "hacked" on the filesystem.

You should never allow users to control commands to find, since this package attempts to run every command provided.

Thanks to @miguelafmonteiro for reporting.
Apache Airflow denial of service vulnerability (GHSA-x2mh-8fmc-rqgh)
Aliases: CVE-2023-37379
Published: 2023-08-23T18:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.7.0'}]}]}]

Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server.

Users of Apache Airflow are strongly advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. Additionally, administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface.
GitPython untrusted search path on Windows systems leading to arbitrary code execution (GHSA-wfm5-v35h-vwf4)
Aliases: CVE-2023-40590
Published: 2023-08-29T23:33:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'gitpython'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.33'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.1.32'}}]

### Summary

When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment (see big warning in https://docs.python.org/3/library/subprocess.html#popen-constructor). GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user's `PATH`.

### Details

This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo.

The execution of the `git` command happens in

https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/cmd.py#L277 

https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/cmd.py#L983-L996

And there are other commands executed that should probably be aware of this problem.

### PoC

On a Windows system, create a `git.exe` or `git` executable in any directory, and import or run GitPython from that directory

```
python -c "import git"
```

The git executable from the current directory will be run.

### Impact

An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands.

### Possible solutions
 
- Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation).
- Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems.
- Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path.
- Resolve the executable manually by only looking into the `PATH` environment variable (suggested by @Byron)

---

> [!NOTE]
> This vulnerability was reported via email, and it was decided to publish it here and make it public, so the community is aware of it, and a fix can be provided.
import-in-the-middle has unsanitized user controlled input in module generation (GHSA-5r27-rw8r-7967)
Aliases: CVE-2023-38704
Published: 2023-08-08T19:26:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'import-in-the-middle'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.4.1'}}]

### Impact
The `import-in-the-middle` loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. It allows for remote code execution in cases where an application passes user-supplied input directly to an import() function.

### Patches
This vulnerability has been patched in `import-in-the-middle` version 1.4.2

### Workarounds
* Do not pass any user-supplied input to `import()`. Instead, verify it against a set of allowed values.
* If using `import-in-the-middle` and support for EcmaScript Modules is not needed, ensure that none of the following options are set (either via command-line or the `NODE_OPTIONS` environment variable):
```
--loader=import-in-the-middle/hook.mjs
--loader import-in-the-middle/hook.mjs
```

### References
If you have any questions or comments about this advisory, email us at [security@datadoghq.com](mailto:security@datadoghq.com)
Cockpit Cross-site Scripting vulnerability (GHSA-3vf5-xm2p-6mh5)
Aliases: CVE-2023-4321
Published: 2023-08-14T12:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.6.2'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit 2.6.2 and prior. A patch is available at commit 34ab31ee9362da51b9709e178469dbffd7717249.
Jettison parser crash by stackoverflow (GHSA-xqcq-j8w9-3pxv)
Published: 2023-08-01T19:53:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.tencyle.fixes:org.codehaus.jettison--jettison'}, 'versions': ['1.1-tencyle-2.1.0']}]

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

### References

- https://nvd.nist.gov/vuln/detail/CVE-2022-40149
- https://github.com/jettison-json/jettison/issues/45
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538
- https://github.com/jettison-json/jettison/pull/49/files
- https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1
- https://lists.debian.org/debian-lts-announce/2022/11/msg00011.html
- https://www.debian.org/security/2023/dsa-5312
Jenkins Delphix Plugin vulnerable to exposure of system-scoped credentials (GHSA-wwww-xvm2-62w7)
Aliases: CVE-2023-40345
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:delphix'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.3'}]}]}]

Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.

This allows attackers with Overall/Read permission to access and capture credentials they are not entitled to.

Delphix Plugin 3.0.3 defines the appropriate context for credentials lookup.
Cockpit Cross-site Scripting vulnerability (GHSA-g3mv-64h3-h482)
Aliases: CVE-2023-4451
Published: 2023-08-20T15:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.6.3'}]}]}]

Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit version 2.6.3 and prior. A patch is available at commit 30609466c817e39f9de1871559603e93cd4d0d0c and anticipated to be part of version 2.6.4.
PyroCMS remote code execution vulnerability (GHSA-w7vm-4v3j-vgpw)
Aliases: CVE-2023-29689
Published: 2023-08-04T15:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pyrocms/pyrocms'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.9'}]}]}]

PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw. This vulnerability allows a malicious attacker to send customized commands to the server and execute arbitrary code on the affected system.
webpki: CPU denial of service in certificate path building (GHSA-8qv2-5vq6-g2g7)
Published: 2023-08-25T00:12:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'webpki'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.22.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.22.0'}}]

When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building.

Both TLS clients and TLS servers that accept client certificate are affected.

This was previously reported in https://github.com/briansmith/webpki/issues/69.

`rustls-webpki` is a fork of this crate which contains a fix for this issue and is actively maintained.
Cockpit Cross-site Scripting vulnerability (GHSA-8m65-qq6g-43rr)
Aliases: CVE-2023-4422
Published: 2023-08-18T21:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.3'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
@adobe/css-tools Regular Expression Denial of Service (ReDOS) while Parsing CSS (GHSA-hpx4-r86g-5jrg)
Aliases: CVE-2023-26364
Published: 2023-08-29T23:33:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': '@adobe/css-tools'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.3.1'}]}]}]

### Impact
@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

### Patches
The issue has been resolved in 4.3.1.

### Workarounds
None

### References
N/A
Active Support Possibly Discloses Locally Encrypted Files (GHSA-cr5q-6q9f-rq6q)
Aliases: CVE-2023-38037
Published: 2023-08-23T20:36:24Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'activesupport'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.2.0'}, {'fixed': '6.1.7.5'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'activesupport'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.0.7.1'}]}]}]

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5

# Impact
ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.

Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.

All users running an affected release should either upgrade or use one of the workarounds immediately.

# Releases
The fixed releases are available at the normal locations.

# Workarounds
To work around this issue, you can set your umask to be more restrictive like this:

```ruby
$ umask 0077
```
Apache Airflow Spark Provider Improper Input Validation vulnerability (GHSA-r2f6-6928-fh8f)
Aliases: CVE-2023-40272
Published: 2023-08-17T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-apache-spark'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.1.3'}]}]}]

Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server.
It is recommended to upgrade to a version that is not affected.
Margox Braft-Editor Cross-site Scripting Vulnerability (GHSA-jfrf-vv54-j2jg)
Aliases: CVE-2021-27524
Published: 2023-08-11T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'braft-editor'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.3.8'}]}]}]

Cross Site Scripting (XSS) vulnerability in margox braft-editor version 2.3.8, allows remote attackers to execute arbitrary code via the embed media feature.
Esoteric YamlBeans XML Entity Expansion vulnerability (GHSA-vj49-j7rc-h54f)
Aliases: CVE-2023-24620
Published: 2023-08-25T21:30:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.esotericsoftware.yamlbeans:yamlbeans'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.15'}]}]}]

An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size, causing CPU and memory consumption, such as a Java Out-of-Memory exception.
When `ui.isAccessAllowed` is `undefined`, the `adminMeta` GraphQL query is publicly accessible (GHSA-9cvc-v7wm-992c)
Aliases: CVE-2023-40027
Published: 2023-08-15T20:04:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@keystone-6/core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.5.1'}]}]}]

### Summary
When `ui.isAccessAllowed` is `undefined`, the `adminMeta` GraphQL query is publicly accessible, that is to say, no session is required for the query.

This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly accessible if a `session` strategy is not defined. 

### Impact
This vulnerability does not affect developers using the `@keystone-6/auth` package, or any users that have written their own `ui.isAccessAllowed` (that is to say, you are unaffected if `ui.isAccessAllowed` is defined).

This vulnerability does affect developers who thought that their `session` strategy will, by default, enforce that `adminMeta` is inaccessible by the public in accordance with that strategy; akin to the behaviour of the AdminUI middleware.

### Patches
This vulnerability has been patched in `@keystone-6/core` version `5.5.1`.

### Workarounds
You can opt to write your own `isAccessAllowed` to work-around this vulnerability.

### References
Pull request https://github.com/keystonejs/keystone/pull/8771
Open Redirect Vulnerability in jupyter-server (GHSA-r726-vmfq-j9j3)
Aliases: CVE-2023-39968
Published: 2023-08-29T23:34:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'jupyter-server'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.7.2'}]}]}]

### Impact

Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers  can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs.


### Patches

Upgrade to Jupyter Server 2.7.2

### Workarounds

None.

### References

Vulnerability reported by user davwwwx via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).

- https://blog.xss.am/2023/08/CVE-2023-39968-jupyter-token-leak/
XWiki Platform privilege escalation (PR)/RCE from account through Invitation subject/message (GHSA-7954-6m9q-gpvf)
Aliases: CVE-2023-37914
Published: 2023-08-18T21:50:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-invitation-ui'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5-m-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-invitation-ui'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-invitation-ui'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.2-rc-1'}]}]}]

### Impact
Any user who can view `Invitation.WebHome` can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This can be reproduced with the following steps:


1.    Open the invitation application (Invitation.WebHome).
1.    Set the subject to `{{cache}}{{groovy}}new File("/tmp/exploit.txt").withWriter { out -> out.println("Attacked from invitation!"); }{{/groovy}}{{/cache}}`
1.    Click "Preview"


### Patches
The vulnerability has been patched on XWiki 14.4.8, 15.2-rc-1, and 14.10.6.

### Workarounds
The vulnerability can be patched manually by applying the [patch](https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591) on `Invitation.InvitationCommon` and `Invitation.InvitationConfig`.

### References
- https://jira.xwiki.org/browse/XWIKI-20421
- https://github.com/xwiki/xwiki-platform/commit/ff1d8a1790c6ee534c6a4478360a06efeb2d3591

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)