Vulnerability-Lookup

CVE-2024-36119 (GCVE-0-2024-36119)

Vulnerability from cvelistv5 – Published: 2024-05-30 20:57 – Updated: 2024-08-02 03:30

Title

Password confirmation stored in plain text via registration form in statamic/cms

Summary

Statamic is a, Laravel + Git powered CMS designed for building websites. In affected versions users registering via the `user:register_form` tag will have their password confirmation stored in plain text in their user file. This only affects sites matching **all** of the following conditions: 1. Running Statamic versions between 5.3.0 and 5.6.1. (This version range represents only one calendar week), 2. Using the `user:register_form` tag. 3. Using file-based user accounts. (Does not affect users stored in a database.), 4. Has users that have registered during that time period. (Existing users are not affected.). Additionally passwords are only visible to users that have access to read user yaml files, typically developers of the application itself. This issue has been patched in version 5.6.2, however any users registered during that time period and using the affected version range will still have the the `password_confirmation` value in their yaml files. We recommend that affected users have their password reset. System administrators are advised to upgrade their deployments. There are no known workarounds for this vulnerability. Anyone who commits their files to a public git repo, may consider clearing the sensitive data from the git history as it is likely that passwords were uploaded.

Severity ?

1.8 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

GitHub_M

References

URL

Tags

	https://github.com/statamic/cms/security/advisori…	x_refsource_CONFIRM
	https://github.com/statamic/cms/commit/0b804306c9…	x_refsource_MISC
	https://dev.to/balogh08/cleaning-your-git-history…	x_refsource_MISC
	https://docs.github.com/en/authentication/keeping…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	statamic	cms	Affected: >= 5.3.0, < 5.6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36119",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-30T23:13:39.305717Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-24T15:08:26.817Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:12.952Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/statamic/cms/security/advisories/GHSA-qvpj-w7xj-r6w9",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/statamic/cms/security/advisories/GHSA-qvpj-w7xj-r6w9"
          },
          {
            "name": "https://github.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e"
          },
          {
            "name": "https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5"
          },
          {
            "name": "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cms",
          "vendor": "statamic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.3.0, \u003c 5.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Statamic is a, Laravel + Git powered CMS designed for building websites. In affected versions users registering via the `user:register_form` tag will have their password confirmation stored in plain text in their user file. This only affects sites matching **all** of the following conditions: 1. Running Statamic versions between 5.3.0 and 5.6.1. (This version range represents only one calendar week), 2. Using the `user:register_form` tag. 3. Using file-based user accounts. (Does not affect users stored in a database.), 4. Has users that have registered during that time period. (Existing users are not affected.). Additionally passwords are only visible to users that have access to read user yaml files, typically developers of the application itself. This issue has been patched in version 5.6.2, however any users registered during that time period and using the affected version range will still have the the `password_confirmation` value in their yaml files. We recommend that affected users have their password reset. System administrators are advised to upgrade their deployments. There are no known workarounds for this vulnerability. Anyone who commits their files to a public git repo, may consider clearing the sensitive data from the git history as it is likely that passwords were uploaded."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 1.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312: Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-30T20:57:06.445Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/statamic/cms/security/advisories/GHSA-qvpj-w7xj-r6w9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/statamic/cms/security/advisories/GHSA-qvpj-w7xj-r6w9"
        },
        {
          "name": "https://github.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e"
        },
        {
          "name": "https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5"
        },
        {
          "name": "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository"
        }
      ],
      "source": {
        "advisory": "GHSA-qvpj-w7xj-r6w9",
        "discovery": "UNKNOWN"
      },
      "title": "Password confirmation stored in plain text via registration form in statamic/cms"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-36119",
    "datePublished": "2024-05-30T20:57:06.445Z",
    "dateReserved": "2024-05-20T21:07:48.189Z",
    "dateUpdated": "2024-08-02T03:30:12.952Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36119\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-30T23:13:39.305717Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-30T23:13:43.764Z\"}}], \"cna\": {\"title\": \"Password confirmation stored in plain text via registration form in statamic/cms\", \"source\": {\"advisory\": \"GHSA-qvpj-w7xj-r6w9\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 1.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"statamic\", \"product\": \"cms\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 5.3.0, \u003c 5.6.2\"}]}], \"references\": [{\"url\": \"https://github.com/statamic/cms/security/advisories/GHSA-qvpj-w7xj-r6w9\", \"name\": \"https://github.com/statamic/cms/security/advisories/GHSA-qvpj-w7xj-r6w9\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e\", \"name\": \"https://github.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5\", \"name\": \"https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository\", \"name\": \"https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Statamic is a, Laravel + Git powered CMS designed for building websites. In affected versions users registering via the `user:register_form` tag will have their password confirmation stored in plain text in their user file. This only affects sites matching **all** of the following conditions: 1. Running Statamic versions between 5.3.0 and 5.6.1. (This version range represents only one calendar week), 2. Using the `user:register_form` tag. 3. Using file-based user accounts. (Does not affect users stored in a database.), 4. Has users that have registered during that time period. (Existing users are not affected.). Additionally passwords are only visible to users that have access to read user yaml files, typically developers of the application itself. This issue has been patched in version 5.6.2, however any users registered during that time period and using the affected version range will still have the the `password_confirmation` value in their yaml files. We recommend that affected users have their password reset. System administrators are advised to upgrade their deployments. There are no known workarounds for this vulnerability. Anyone who commits their files to a public git repo, may consider clearing the sensitive data from the git history as it is likely that passwords were uploaded.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-312\", \"description\": \"CWE-312: Cleartext Storage of Sensitive Information\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-05-30T20:57:06.445Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36119\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-07-24T15:08:26.817Z\", \"dateReserved\": \"2024-05-20T21:07:48.189Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-05-30T20:57:06.445Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-36119

Vulnerability from fkie_nvd - Published: 2024-05-30 21:15 - Updated: 2024-11-21 09:21

Severity ?

1.8 (Low) - CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5
	security-advisories@github.com	https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository
	security-advisories@github.com	https://github.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e
	security-advisories@github.com	https://github.com/statamic/cms/security/advisories/GHSA-qvpj-w7xj-r6w9
	af854a3a-2127-422b-91ae-364da2661108	https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5
	af854a3a-2127-422b-91ae-364da2661108	https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/statamic/cms/security/advisories/GHSA-qvpj-w7xj-r6w9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Statamic is a, Laravel + Git powered CMS designed for building websites. In affected versions users registering via the `user:register_form` tag will have their password confirmation stored in plain text in their user file. This only affects sites matching **all** of the following conditions: 1. Running Statamic versions between 5.3.0 and 5.6.1. (This version range represents only one calendar week), 2. Using the `user:register_form` tag. 3. Using file-based user accounts. (Does not affect users stored in a database.), 4. Has users that have registered during that time period. (Existing users are not affected.). Additionally passwords are only visible to users that have access to read user yaml files, typically developers of the application itself. This issue has been patched in version 5.6.2, however any users registered during that time period and using the affected version range will still have the the `password_confirmation` value in their yaml files. We recommend that affected users have their password reset. System administrators are advised to upgrade their deployments. There are no known workarounds for this vulnerability. Anyone who commits their files to a public git repo, may consider clearing the sensitive data from the git history as it is likely that passwords were uploaded."
    },
    {
      "lang": "es",
      "value": "Statamic es un CMS con tecnolog\u00eda Laravel + Git manipulado para crear sitios web. En las versiones afectadas, los usuarios que se registren a trav\u00e9s de la etiqueta `user:register_form` tendr\u00e1n la confirmaci\u00f3n de su contrase\u00f1a almacenada en texto sin formato en su archivo de usuario. Esto solo afecta a los sitios que cumplen **todas** las siguientes condiciones: 1. Ejecutar versiones de Statamic entre 5.3.0 y 5.6.1. (Este rango de versiones representa solo una semana calendario), 2. Usando la etiqueta `user:register_form`. 3. Usar cuentas de usuario basadas en archivos. (No afecta a los usuarios almacenados en una base de datos). 4. Tiene usuarios que se han registrado durante ese per\u00edodo de tiempo. (Los usuarios existentes no se ven afectados). Adem\u00e1s, las contrase\u00f1as solo son visibles para los usuarios que tienen acceso para leer archivos yaml de usuario, generalmente desarrolladores de la propia aplicaci\u00f3n. Este problema se solucion\u00f3 en la versi\u00f3n 5.6.2; sin embargo, cualquier usuario registrado durante ese per\u00edodo de tiempo y que utilice el rango de versiones afectado a\u00fan tendr\u00e1 el valor `password_confirmation` en sus archivos yaml. Recomendamos que los usuarios afectados restablezcan su contrase\u00f1a. Se recomienda a los administradores del sistema que actualicen sus implementaciones. No se conocen workarounds para esta vulnerabilidad. Cualquiera que env\u00ede sus archivos a un repositorio p\u00fablico de git puede considerar borrar los datos confidenciales del historial de git, ya que es probable que se hayan cargado contrase\u00f1as."
    }
  ],
  "id": "CVE-2024-36119",
  "lastModified": "2024-11-21T09:21:39.660",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 1.8,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.3,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-05-30T21:15:09.460",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-qvpj-w7xj-r6w9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-qvpj-w7xj-r6w9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-QVPJ-W7XJ-R6W9

Vulnerability from github – Published: 2024-06-02 22:30 – Updated: 2024-06-02 22:30

Summary

Password confirmation stored in plain text via registration form in statamic/cms

Details

Users registering via the user:register_form tag will have their password confirmation stored in plain text in their user file.

Impact

This only affects sites matching all of the following conditions: - Running Statamic versions between 5.3.0 and 5.6.1. (This version range represents only one calendar week) - Using the user:register_form tag. - Using file-based user accounts. (Does not affect users stored in a database.) - Has users that have registered during that time period. (Existing users are not affected.)

The password is only visible to users that have access to read user yaml files, typically developers of the application itself.

Patches

The issue has been patched in 5.6.2, however any users registered during that time period and using the affected version range will still have the the password_confirmation value in their yaml files.

We recommend that affected users have their password reset. The following query can be entered into php artisan tinker and will output a list of affected emails:

Statamic\Facades\User::query()->whereNotNull('password_confirmation')->get()->map->email

The following can be entered into tinker and will clear both password_confirmation as well as their existing password. They will be required to reset their password before their next login attempt.

Statamic\Facades\User::query()
  ->whereNotNull('password_confirmation')->get()
  ->each(fn ($user) => $user->remove('password_confirmation')->passwordHash(null)->save());

References

If you are committing user files to a public git repo, you may consider clearing the sensitive data from the git history. You can use the following links for details. - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository - https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5

Severity ?

1.8 (Low)


                  
                    CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "statamic/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.3.0"
            },
            {
              "fixed": "5.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-36119"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-02T22:30:45Z",
    "nvd_published_at": "2024-05-30T21:15:09Z",
    "severity": "LOW"
  },
  "details": "Users registering via the `user:register_form` tag will have their password confirmation stored in plain text in their user file.\n\n### Impact\nThis only affects sites matching **all** of the following conditions:\n- Running Statamic versions between 5.3.0 and 5.6.1. (This version range represents only one calendar week)\n- Using the `user:register_form` tag.\n- Using file-based user accounts. (Does not affect users stored in a database.)\n- Has users that have registered during that time period. (Existing users are not affected.)\n\nThe password is only visible to users that have access to read user yaml files, typically developers of the application itself.\n\n### Patches\nThe issue has been patched in 5.6.2, however any users registered during that time period and using the affected version range will still have the the `password_confirmation` value in their yaml files.\n\nWe recommend that affected users have their password reset. The following query can be entered into `php artisan tinker` and will output a list of affected emails:\n\n```php\nStatamic\\Facades\\User::query()-\u003ewhereNotNull(\u0027password_confirmation\u0027)-\u003eget()-\u003emap-\u003eemail\n```\n\nThe following can be entered into `tinker` and will clear both password_confirmation as well as their existing password. They will be required to reset their password before their next login attempt.\n\n```php\nStatamic\\Facades\\User::query()\n  -\u003ewhereNotNull(\u0027password_confirmation\u0027)-\u003eget()\n  -\u003eeach(fn ($user) =\u003e $user-\u003eremove(\u0027password_confirmation\u0027)-\u003epasswordHash(null)-\u003esave());\n```\n\n### References\nIf you are committing user files to a public git repo, you may consider clearing the sensitive data from the git history. You can use the following links for details.\n- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository\n- https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5",
  "id": "GHSA-qvpj-w7xj-r6w9",
  "modified": "2024-06-02T22:30:45Z",
  "published": "2024-06-02T22:30:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-qvpj-w7xj-r6w9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36119"
    },
    {
      "type": "WEB",
      "url": "https://github.com/statamic/cms/commit/0b804306c96c99b81755d5bd02df87ddf392853e"
    },
    {
      "type": "WEB",
      "url": "https://dev.to/balogh08/cleaning-your-git-history-safely-removing-sensitive-data-10i5"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/statamic/cms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Password confirmation stored in plain text via registration form in statamic/cms"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-36119 (GCVE-0-2024-36119)

FKIE_CVE-2024-36119

GHSA-QVPJ-W7XJ-R6W9

Impact

Patches

References

Tags

Sightings

Nomenclature