Skip to content

Commit 4ce29dc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6xvf-4vh9-mw47 GHSA-8x9v-8qgj-945x
1 parent 6ab3c90 commit 4ce29dc

File tree

2 files changed

+98
-8
lines changed

2 files changed

+98
-8
lines changed

‎advisories/github-reviewed/2025/11/GHSA-6xvf-4vh9-mw47/GHSA-6xvf-4vh9-mw47.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6xvf-4vh9-mw47",
4+
"modified": "2025-11-20T21:57:01Z",
5+
"published": "2025-11-20T21:57:01Z",
6+
"aliases": [],
7+
"summary": "Minder does not sandbox http.send in Rego programs",
8+
"details": "### Impact\n\nMinder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to (for example, if the Minder server is behind a firewall or other network partition).\n\n### Patches\n\nhttps://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8\n\n### Workarounds\n\nUsers should avoid deploying Minder with access to sensitive resources. Unfortunately, this could include access to systems like OpenFGA or Keycloak, depending on the deployment configuration.\n\n### References\n\nSample ruletype:\n\n```yaml\nversion: v1\ntype: rule-type\nname: test-http-send\ndisplay_name: Test that we can call http.send\nshort_failure_message: Failed http.send\nseverity:\n value: medium\ncontext:\n provider: github\ndescription: |\n ...\nguidance: |\n ....\ndef:\n in_entity: repository\n rule_schema:\n type: object\n properties: {}\n ingest:\n type: git\n git: {}\n eval:\n type: rego\n violation_format: text\n rego:\n type: constraints\n def: |\n package minder\n\n import rego.v1\n\n violations contains {\"msg\": \"Check-execution\"}\n\n resp := http.send({\n \"method\": \"GET\",\n \"url\": \"http://openfga:8080/\",\n \"raise_error\": false,\n })\n\n violations contains {\"msg\": sprintf(\"Response: %s\", [resp.status])}\n\n details := sprintf(\"High score: %s\", [resp.body.summary])\n\n violations contains {\"msg\": sprintf(\"Response body: %s\", [resp.body]) } if {\n resp.status_code > 0\n }\n```\n\nExample policy:\n\n```yaml\nversion: v1\ntype: profile\nname: Test-HTTP-send\ndisplay_name: Test if we can do http.send\ncontext:\n provider: github\nalert: \"off\"\nremediate: \"off\"\nrepository:\n - type: test-http-send\n def: {}\n```\n\nEvaluation results:\n\n```sh\n$ minder profile status list -n test-http-send --json\n{\n \"profileStatus\": {\n \"profileId\": \"3b3e0918-4deb-49cc-b4c9-1d1d912cf784\",\n \"profileName\": \"Test-HTTP-send\",\n \"profileStatus\": \"failure\",\n \"lastUpdated\": \"2024-10-31T03:44:01.456359Z\"\n },\n \"ruleEvaluationStatus\": [\n {\n \"profileId\": \"3b3e0918-4deb-49cc-b4c9-1d1d912cf784\",\n \"ruleId\": \"c0ebac2c-cfe2-4a98-b0a6-d6971209653e\",\n \"ruleName\": \"test-http-send\",\n \"entity\": \"repository\",\n \"status\": \"failure\",\n \"lastUpdated\": \"2024-10-31T03:44:01.456359Z\",\n \"entityInfo\": {\n \"entity_id\": \"a7f7a4bc-4430-4e9a-86a9-ffa026db6343\",\n \"entity_type\": \"repository\",\n \"name\": \"a-random-sandbox/colorls\",\n \"provider\": \"github-app-a-random-sandbox\",\n \"repo_name\": \"colorls\",\n \"repo_owner\": \"a-random-sandbox\",\n \"repository_id\": \"a7f7a4bc-4430-4e9a-86a9-ffa026db6343\"\n },\n \"details\": \"Multiple issues:\\n* Check-execution\\n* Response body: {\\\"code\\\": \\\"undefined_endpoint\\\", \\\"message\\\": \\\"Not Found\\\"}\\n* Response: 404 Not Found\\n\",\n \"guidance\": \"....\\n\",\n \"remediationStatus\": \"skipped\",\n \"remediationLastUpdated\": \"2024-10-31T03:44:01.456359Z\",\n \"ruleTypeName\": \"test-http-send\",\n \"ruleDescriptionName\": \"Test that we can call http.send\",\n \"alert\": {\n \"status\": \"skipped\",\n \"lastUpdated\": \"2024-10-31T03:44:01.456359Z\"\n },\n \"ruleDisplayName\": \"Test that we can call http.send\",\n \"releasePhase\": \"RULE_TYPE_RELEASE_PHASE_ALPHA\"\n }\n ]\n}\n```",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/mindersec/minder"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0.0.72"
27+
},
28+
{
29+
"fixed": "0.0.84"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 0.0.83"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/mindersec/minder"
51+
}
52+
],
53+
"database_specific": {
54+
"cwe_ids": [
55+
"CWE-830"
56+
],
57+
"severity": "HIGH",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2025-11-20T21:57:01Z",
60+
"nvd_published_at": null
61+
}
62+
}

advisories/unreviewed/2025/11/GHSA-8x9v-8qgj-945x/GHSA-8x9v-8qgj-945x.json renamed to advisories/github-reviewed/2025/11/GHSA-8x9v-8qgj-945x/GHSA-8x9v-8qgj-945x.json

Lines changed: 36 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8x9v-8qgj-945x",
4-
"modified": "2025-11-20T18:31:01Z",
4+
"modified": "2025-11-20T21:56:31Z",
55
"published": "2025-11-20T18:31:01Z",
66
"aliases": [
77
"CVE-2025-64027"
88
],
9+
"summary": "Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow",
910
"details": "Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page.",
10-
"severity": [],
11-
"affected": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "snipe/snipe-it"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "8.3.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1238
"references": [
1339
{
1440
"type": "ADVISORY",
@@ -19,15 +45,17 @@
1945
"url": "https://github.com/cybercrewinc/CVE-2025-64027"
2046
},
2147
{
22-
"type": "WEB",
48+
"type": "PACKAGE",
2349
"url": "https://github.com/grokability/snipe-it"
2450
}
2551
],
2652
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
29-
"github_reviewed": false,
30-
"github_reviewed_at": null,
53+
"cwe_ids": [
54+
"CWE-79"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-11-20T21:56:31Z",
3159
"nvd_published_at": "2025-11-20T17:15:52Z"
3260
}
3361
}

0 commit comments

Comments
 (0)