bitnami · bitnami-bot · Jan 11, 2025 · Jan 11, 2025
diff --git a/data/consul/BIT-consul-2024-10005.json b/data/consul/BIT-consul-2024-10005.json
@@ -15,7 +15,7 @@
       "severity": [
         {
           "type": "CVSS_V3",
-          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
+          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
         }
       ],
       "ranges": [
@@ -58,7 +58,7 @@
     }
   ],
   "database_specific": {
-    "severity": "Medium",
+    "severity": "High",
     "cpes": [
       "cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*",
       "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*",
@@ -70,8 +70,12 @@
     {
       "type": "WEB",
       "url": "https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.netapp.com/advisory/ntap-20250110-0004/"
     }
   ],
   "published": "2024-11-01T07:08:02.109Z",
-  "modified": "2024-11-09T07:38:29.950Z"
+  "modified": "2025-01-11T07:38:25.737Z"
 }
diff --git a/data/consul/BIT-consul-2024-10006.json b/data/consul/BIT-consul-2024-10006.json
@@ -15,7 +15,7 @@
       "severity": [
         {
           "type": "CVSS_V3",
-          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
+          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
         }
       ],
       "ranges": [
@@ -58,7 +58,7 @@
     }
   ],
   "database_specific": {
-    "severity": "Medium",
+    "severity": "High",
     "cpes": [
       "cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*",
       "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*",
@@ -70,8 +70,12 @@
     {
       "type": "WEB",
       "url": "https://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.netapp.com/advisory/ntap-20250110-0005/"
     }
   ],
   "published": "2024-11-01T07:07:54.503Z",
-  "modified": "2024-11-09T07:38:29.950Z"
+  "modified": "2025-01-11T07:38:25.737Z"
 }
diff --git a/data/consul/BIT-consul-2024-10086.json b/data/consul/BIT-consul-2024-10086.json
@@ -64,8 +64,12 @@
     {
       "type": "WEB",
       "url": "https://discuss.hashicorp.com/t/hcsec-2024-24-consul-vulnerable-to-reflected-xss-on-content-type-error-manipulation"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.netapp.com/advisory/ntap-20250110-0006/"
     }
   ],
   "published": "2024-11-01T07:07:47.800Z",
-  "modified": "2024-11-02T07:36:38.597Z"
+  "modified": "2025-01-11T07:38:25.737Z"
 }
diff --git a/data/mattermost/BIT-mattermost-2024-23493.json b/data/mattermost/BIT-mattermost-2024-23493.json
@@ -0,0 +1,88 @@
+{
+  "schema_version": "1.5.0",
+  "id": "BIT-mattermost-2024-23493",
+  "details": "Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of. ",
+  "aliases": [
+    "CVE-2024-23493"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Bitnami",
+        "name": "mattermost",
+        "purl": "pkg:bitnami/mattermost"
+      },
+      "severity": [
+        {
+          "type": "CVSS_V3",
+          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+        }
+      ],
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "8.1.9"
+            },
+            {
+              "introduced": "9.0.0"
+            },
+            {
+              "fixed": "9.2.5"
+            },
+            {
+              "introduced": "9.4.0"
+            },
+            {
+              "fixed": "9.4.2"
+            }
+          ]
+        },
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "9.3.0"
+            },
+            {
+              "last_affected": "9.3.0"
+            },
+            {
+              "introduced": "9.3.0-rc1"
+            },
+            {
+              "last_affected": "9.3.0-rc1"
+            },
+            {
+              "introduced": "9.3.0-rc2"
+            },
+            {
+              "last_affected": "9.3.0-rc2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "database_specific": {
+    "severity": "Medium",
+    "cpes": [
+      "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
+      "cpe:2.3:a:mattermost:mattermost_server:9.3.0:-:*:*:*:*:*:*",
+      "cpe:2.3:a:mattermost:mattermost_server:9.3.0:rc1:*:*:*:*:*:*",
+      "cpe:2.3:a:mattermost:mattermost_server:9.3.0:rc2:*:*:*:*:*:*"
+    ]
+  },
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://mattermost.com/security-updates"
+    }
+  ],
+  "published": "2025-01-11T07:15:39.107Z",
+  "modified": "2025-01-11T07:38:25.737Z"
+}
diff --git a/data/mattermost/BIT-mattermost-2024-24988.json b/data/mattermost/BIT-mattermost-2024-24988.json
@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.5.0",
+  "id": "BIT-mattermost-2024-24988",
+  "details": "Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.",
+  "aliases": [
+    "CVE-2024-24988"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Bitnami",
+        "name": "mattermost",
+        "purl": "pkg:bitnami/mattermost"
+      },
+      "severity": [
+        {
+          "type": "CVSS_V3",
+          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
+        }
+      ],
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "8.1.8"
+            },
+            {
+              "introduced": "9.0.0"
+            },
+            {
+              "fixed": "9.1.5"
+            },
+            {
+              "introduced": "9.2.0"
+            },
+            {
+              "fixed": "9.2.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "database_specific": {
+    "severity": "Medium",
+    "cpes": [
+      "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*"
+    ]
+  },
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://mattermost.com/security-updates"
+    }
+  ],
+  "published": "2025-01-11T07:14:49.615Z",
+  "modified": "2025-01-11T07:38:25.737Z"
+}
diff --git a/data/php/BIT-php-2024-8929.json b/data/php/BIT-php-2024-8929.json
@@ -55,8 +55,12 @@
     {
       "type": "WEB",
       "url": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.netapp.com/advisory/ntap-20250110-0008/"
     }
   ],
   "published": "2024-11-27T19:18:36.988Z",
-  "modified": "2024-11-27T19:40:48.342Z"
+  "modified": "2025-01-11T07:38:25.737Z"
 }
diff --git a/data/php/BIT-php-2024-8932.json b/data/php/BIT-php-2024-8932.json
@@ -55,8 +55,12 @@
     {
       "type": "WEB",
       "url": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.netapp.com/advisory/ntap-20250110-0009/"
     }
   ],
   "published": "2024-11-27T19:18:28.985Z",
-  "modified": "2024-11-27T19:40:48.342Z"
+  "modified": "2025-01-11T07:38:25.737Z"
 }
diff --git a/data/postgresql/BIT-postgresql-2024-10979.json b/data/postgresql/BIT-postgresql-2024-10979.json
@@ -77,8 +77,12 @@
     {
       "type": "WEB",
       "url": "https://github.com/fmora50591/postgresql-env-vuln/blob/main/README.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.netapp.com/advisory/ntap-20250110-0003/"
     }
   ],
   "published": "2024-11-16T07:16:38.797Z",
-  "modified": "2024-11-27T19:40:48.342Z"
+  "modified": "2025-01-11T07:38:25.737Z"
 }
diff --git a/data/vault/BIT-vault-2024-7594.json b/data/vault/BIT-vault-2024-7594.json
@@ -43,8 +43,12 @@
     {
       "type": "WEB",
       "url": "https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.netapp.com/advisory/ntap-20250110-0007/"
     }
   ],
   "published": "2024-09-30T09:10:31.036Z",
-  "modified": "2024-09-30T09:34:51.259Z"
+  "modified": "2025-01-11T07:38:25.737Z"
 }