[GHSA-x2jc-989c-47q4] Hexo up to v7.0.0 (RC2) was discovered to contain an... #6088
Conversation
github-actions
bot
changed the base branch from
main
to
uiolee/advisory-improvement-6088
There was a problem hiding this comment.
Pull Request Overview
This PR updates a security advisory for Hexo's arbitrary file read vulnerability (GHSA-x2jc-989c-47q4) by adding comprehensive details including affected package information, proper CVSS scoring, and additional references.
- Updates CVSS score from HIGH to LOW severity with more accurate vector scoring
- Adds complete affected package information for npm ecosystem with version ranges
- Includes additional source code reference and corrects version details
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| "published": "2023-09-08T15:30:18Z", | ||
| "aliases": [ | ||
| "CVE-2023-39584" | ||
| ], | ||
| "details": "Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.", | ||
| "summary": "hexo \"include_code\" path traversal", | ||
| "details": "Hexo up to v7.1.1 was discovered to contain an arbitrary file read vulnerability.", |
There was a problem hiding this comment.
The details field should provide more specific information about the vulnerability mechanism. Consider adding details about the path traversal nature of the vulnerability and the affected 'include_code' functionality as indicated in the summary.
| "details": "Hexo up to v7.1.1 was discovered to contain an arbitrary file read vulnerability.", | |
| "details": "Hexo up to v7.1.1 contains a path traversal vulnerability in the 'include_code' functionality. By supplying crafted input to the 'include_code' tag, an attacker can read arbitrary files from the server's filesystem outside the intended directory. This issue allows unauthorized access to sensitive files via directory traversal.", |
Copilot uses AI. Check for mistakes.
| @@ -27,6 +51,10 @@ | |||
| "type": "WEB", | |||
| "url": "https://github.com/hexojs/hexo/blob/a3e68e7576d279db22bd7481914286104e867834/lib/plugins/tag/include_code.js#L49" | |||
| }, | |||
| { | |||
| "type": "PACKAGE", | |||
There was a problem hiding this comment.
The reference type should be 'WEB' instead of 'PACKAGE' for consistency with the existing source code reference. The 'PACKAGE' type is typically reserved for package registry URLs.
| "type": "PACKAGE", | |
| "type": "WEB", |
Copilot uses AI. Check for mistakes.
advisory-database
bot
merged commit ef87364
into
uiolee/advisory-improvement-6088
|
Hi @uiolee! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
add more detail