Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/vulndb: potential Go vuln in github.com/pydio/cells: GHSA-wmfc-g86p-fjvr #1809

Closed
GoVulnBot opened this issue May 31, 2023 · 3 comments
Closed
Assignees
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-wmfc-g86p-fjvr, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/pydio/cells 4.2.1 < 4.2.1

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/pydio/cells
    versions:
      - fixed: 4.2.1
    packages:
      - package: github.com/pydio/cells
summary: 'go package pydio cells vulnerable to cross-site scripting '
description: A vulnerability, which was classified as problematic, has been found
    in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processing of the
    component Chat. The manipulation leads to basic cross site scripting. The attack
    may be initiated remotely. Upgrading to version 4.2.1 is able to address this
    issue. It is recommended to upgrade the affected component. The identifier VDB-230213
    was assigned to this vulnerability.
cves:
  - CVE-2023-2981
ghsas:
  - GHSA-wmfc-g86p-fjvr
references:
  - web: https://nvd.nist.gov/vuln/detail/CVE-2023-2981
  - web: https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421
  - web: https://vuldb.com/?ctiid.230213
  - web: https://vuldb.com/?id.230213
  - advisory: https://github.com/advisories/GHSA-wmfc-g86p-fjvr

@tatianab tatianab self-assigned this Jun 2, 2023
@tatianab tatianab added the excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. label Jun 7, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/501842 mentions this issue: data/excluded: batch add 15 excluded reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/606786 mentions this issue: data/reports: unexclude 20 reports (6)

gopherbot pushed a commit that referenced this issue Aug 20, 2024
  - data/reports/GO-2023-1785.yaml
  - data/reports/GO-2023-1793.yaml
  - data/reports/GO-2023-1795.yaml
  - data/reports/GO-2023-1800.yaml
  - data/reports/GO-2023-1801.yaml
  - data/reports/GO-2023-1803.yaml
  - data/reports/GO-2023-1804.yaml
  - data/reports/GO-2023-1806.yaml
  - data/reports/GO-2023-1808.yaml
  - data/reports/GO-2023-1809.yaml
  - data/reports/GO-2023-1819.yaml
  - data/reports/GO-2023-1827.yaml
  - data/reports/GO-2023-1828.yaml
  - data/reports/GO-2023-1829.yaml
  - data/reports/GO-2023-1831.yaml
  - data/reports/GO-2023-1849.yaml
  - data/reports/GO-2023-1850.yaml
  - data/reports/GO-2023-1851.yaml
  - data/reports/GO-2023-1852.yaml
  - data/reports/GO-2023-1853.yaml

Updates #1785
Updates #1793
Updates #1795
Updates #1800
Updates #1801
Updates #1803
Updates #1804
Updates #1806
Updates #1808
Updates #1809
Updates #1819
Updates #1827
Updates #1828
Updates #1829
Updates #1831
Updates #1849
Updates #1850
Updates #1851
Updates #1852
Updates #1853

Change-Id: Ib6fb15714358b0a9d7644d6ed43de25bdbd8434b
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/606786
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.
Projects
None yet
Development

No branches or pull requests

3 participants