sharonkoch / orchardcore_demo

Orchard Core is an open-source modular and multi-tenant application framework built with ASP.NET Core, and a content management system (CMS) built on top of that framework.

Orchard Core

Orchard Core consists of two distinct projects:

• Orchard Core Framework: An application framework for building modular, multi-tenant applications on ASP.NET Core.
• Orchard Core CMS: A Web Content Management System (CMS) built on top of the Orchard Core Framework.

Local communities

中文资源

Build Status

Stable (release/1.7.2):

Nightly (main):

Status

1.7.2

The software is finished -- and by finished, we mean there are no show-stopping, little-children-killing bugs in it. That we know of. There are probably numerous lower-priority bugs triaged into the next point release or service pack, as well.

Here is a more detailed roadmap.

Getting Started

• Clone the repository using the command git clone https://github.com/OrchardCMS/OrchardCore.git and checkout the main branch.

Command line

• Install the latest version of the .NET SDK from this page https://dotnet.microsoft.com/download
• Next, navigate to ./OrchardCore/src/OrchardCore.Cms.Web.
• Call dotnet run.
• Then open the http://localhost:5000 URL in your browser.

Visual Studio

• Download Visual Studio 2022 (v17.5+) from https://www.visualstudio.com/downloads/
• Open OrchardCore.sln and wait for Visual Studio to restore all Nuget packages.
• Ensure OrchardCore.Cms.Web is the startup project and run it.

Docker

• Run docker run --name orchardcms -p 8080:80 orchardproject/orchardcore-cms-linux:latest

Docker images and parameters can be found at https://hub.docker.com/u/orchardproject/
See Docker documentation to expose different port.

Documentation

The documentation can be accessed here: https://docs.orchardcore.net/

Code of Conduct

See CODE-OF-CONDUCT

.NET Foundation

This project is supported by the .NET Foundation.

orchardcore_demo's Issues

openiddict.validation.serverintegration.4.10.1.nupkg: 1 vulnerabilities (highest severity is: 6.8)

Vulnerable Library - openiddict.validation.serverintegration.4.10.1.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.identitymodel.jsonwebtokens/7.0.3/microsoft.identitymodel.jsonwebtokens.7.0.3.nupkg

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (openiddict.validation.serverintegration.4.10.1.nupkg version)	Remediation Possible**
CVE-2024-21319	Medium	6.8	microsoft.identitymodel.jsonwebtokens.7.0.3.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-21319

Vulnerable Library - microsoft.identitymodel.jsonwebtokens.7.0.3.nupkg

Includes types that provide support for creating, serializing and validating JSON Web Tokens.

Library home page: https://api.nuget.org/packages/microsoft.identitymodel.jsonwebtokens.7.0.3.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.identitymodel.jsonwebtokens/7.0.3/microsoft.identitymodel.jsonwebtokens.7.0.3.nupkg

Dependency Hierarchy:

• openiddict.validation.serverintegration.4.10.1.nupkg (Root Library)
  • openiddict.validation.4.10.1.nupkg
    • ❌ microsoft.identitymodel.jsonwebtokens.7.0.3.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Microsoft Identity Denial of service vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-21319

CVSS 3 Score Details (6.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8g9c-28fc-mcx2

Release Date: 2024-01-09

Fix Resolution: System.IdentityModel.Tokens.Jwt - 5.7.0,6.34.0,7.1.2, Microsoft.IdentityModel.JsonWebTokens - 5.7.0,6.34.0,7.1.2

OrchardCore.FileStorage.AzureBlob-1.8.0-preview: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - OrchardCore.FileStorage.AzureBlob-1.8.0-preview

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.json/4.7.2/system.text.json.4.7.2.nupkg

Found in HEAD commit: 5279d43f2d4b5305c13128b14818d8a6bf21f5e0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (OrchardCore.FileStorage.AzureBlob version)	Remediation Possible**
CVE-2024-30105	High	7.5	system.text.json.4.7.2.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-30105

Vulnerable Library - system.text.json.4.7.2.nupkg

Provides high-performance and low-allocating types that serialize objects to JavaScript Object Notat...

Library home page: https://api.nuget.org/packages/system.text.json.4.7.2.nupkg

Path to dependency file: /src/OrchardCore/OrchardCore.Notifications.Core/OrchardCore.Notifications.Core.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.json/4.7.2/system.text.json.4.7.2.nupkg

Dependency Hierarchy:

• OrchardCore.FileStorage.AzureBlob-1.8.0-preview (Root Library)
  • azure.storage.blobs.12.19.1.nupkg
    • ❌ system.text.json.4.7.2.nupkg (Vulnerable Library)

Found in HEAD commit: 5279d43f2d4b5305c13128b14818d8a6bf21f5e0

Found in base branch: main

Vulnerability Details

.NET Core and Visual Studio Denial of Service Vulnerability

Publish Date: 2024-07-09

URL: CVE-2024-30105

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hh2w-p6rv-4g7w

Release Date: 2024-07-09

Fix Resolution: System.Text.Json - 8.0.4

azure.extensions.aspnetcore.dataprotection.blobs.1.3.2.nupkg: 1 vulnerabilities (highest severity is: 8.1)

Vulnerable Library - azure.extensions.aspnetcore.dataprotection.blobs.1.3.2.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.DataProtection.Azure/OrchardCore.DataProtection.Azure.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.drawing.common/4.7.0/system.drawing.common.4.7.0.nupkg

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (azure.extensions.aspnetcore.dataprotection.blobs.1.3.2.nupkg version)	Remediation Possible**
CVE-2021-24112	High	8.1	system.drawing.common.4.7.0.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-24112

Vulnerable Library - system.drawing.common.4.7.0.nupkg

Provides access to GDI+ graphics functionality.

Commonly Used Types:
System.Drawing.Bitmap
System.D...

Library home page: https://api.nuget.org/packages/system.drawing.common.4.7.0.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.DataProtection.Azure/OrchardCore.DataProtection.Azure.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.drawing.common/4.7.0/system.drawing.common.4.7.0.nupkg

Dependency Hierarchy:

• azure.extensions.aspnetcore.dataprotection.blobs.1.3.2.nupkg (Root Library)
  • microsoft.aspnetcore.dataprotection.3.1.32.nupkg
    • system.security.cryptography.xml.4.7.1.nupkg
      • system.security.permissions.4.7.0.nupkg
        • system.windows.extensions.4.7.0.nupkg
          • ❌ system.drawing.common.4.7.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

.NET Core Remote Code Execution Vulnerability

Publish Date: 2021-02-25

URL: CVE-2021-24112

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rxg9-xrhp-64gj

Release Date: 2021-02-25

Fix Resolution: System.Drawing.Common - 4.7.2,5.0.3

GitPython-3.1.40-py3-none-any.whl: 1 vulnerabilities (highest severity is: 7.8) - autoclosed

Vulnerable Library - GitPython-3.1.40-py3-none-any.whl

GitPython is a Python library used to interact with Git repositories

Library home page: https://files.pythonhosted.org/packages/8d/c4/82b858fb6483dfb5e338123c154d19c043305b01726a67d89532b8f8f01b/GitPython-3.1.40-py3-none-any.whl

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (GitPython version)	Remediation Possible**
CVE-2024-22190	High	7.8	GitPython-3.1.40-py3-none-any.whl	Direct	GitPython - 3.1.41	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-22190

Vulnerable Library - GitPython-3.1.40-py3-none-any.whl

GitPython is a Python library used to interact with Git repositories

Library home page: https://files.pythonhosted.org/packages/8d/c4/82b858fb6483dfb5e338123c154d19c043305b01726a67d89532b8f8f01b/GitPython-3.1.40-py3-none-any.whl

Dependency Hierarchy:

• ❌ GitPython-3.1.40-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run git, as well as when it runs bash.exe to interpret hooks. If either of those features are used on Windows, a malicious git.exe or bash.exe may be run from an untrusted repository. This issue has been patched in version 3.1.41.

Publish Date: 2024-01-11

URL: CVE-2024-22190

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-22190

Release Date: 2024-01-11

Fix Resolution: GitPython - 3.1.41

OrchardCore.Infrastructure-1.8.0-preview: 5 vulnerabilities (highest severity is: 8.8)

Vulnerable Library - OrchardCore.Infrastructure-1.8.0-preview

Path to vulnerable library: /home/wss-scanner/.nuget/packages/azure.identity/1.7.0/azure.identity.1.7.0.nupkg

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (OrchardCore.Infrastructure version)	Remediation Possible**
CVE-2023-36414	High	8.8	azure.identity.1.7.0.nupkg	Transitive	N/A*	❌
CVE-2024-38095	High	7.5	system.formats.asn1.7.0.0.nupkg	Transitive	N/A*	❌
CVE-2024-21319	Medium	6.8	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2024-35255	Medium	5.5	azure.identity.1.7.0.nupkg	Transitive	N/A*	❌
CVE-2024-29992	Medium	5.5	azure.identity.1.7.0.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-36414

Vulnerable Library - azure.identity.1.7.0.nupkg

This is the implementation of the Azure SDK Client Library for Azure Identity

Library home page: https://api.nuget.org/packages/azure.identity.1.7.0.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.Workflows/OrchardCore.Workflows.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/azure.identity/1.7.0/azure.identity.1.7.0.nupkg

Dependency Hierarchy:

• OrchardCore.Infrastructure-1.8.0-preview (Root Library)
  • OrchardCore.Data.YesSql-1.8.0-preview
    • yessql.3.5.0.nupkg
      • yessql.provider.sqlserver.3.5.0.nupkg
        • microsoft.data.sqlclient.5.1.2.nupkg
          • ❌ azure.identity.1.7.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Azure Identity SDK Remote Code Execution Vulnerability

Publish Date: 2023-10-10

URL: CVE-2023-36414

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-36414

Release Date: 2023-10-10

Fix Resolution: Azure.Identity - 1.10.2

CVE-2024-38095

Vulnerable Library - system.formats.asn1.7.0.0.nupkg

Provides classes that can read and write the ASN.1 BER, CER, and DER data formats.

Commonly Used Types:
System.Formats.Asn1.AsnReader
System.Formats.Asn1.AsnWriter

Library home page: https://api.nuget.org/packages/system.formats.asn1.7.0.0.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.Notifications/OrchardCore.Notifications.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.formats.asn1/7.0.0/system.formats.asn1.7.0.0.nupkg

Dependency Hierarchy:

• OrchardCore.Infrastructure-1.8.0-preview (Root Library)
  • mimekit.4.3.0.nupkg
    • system.security.cryptography.pkcs.7.0.3.nupkg
      • ❌ system.formats.asn1.7.0.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

.NET and Visual Studio Denial of Service Vulnerability

Publish Date: 2024-07-09

URL: CVE-2024-38095

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-447r-wph3-92pm

Release Date: 2024-07-09

Fix Resolution: Microsoft.NetCore.App.Runtime - 6.0.32,8.0.7, System.Formats.Asn1 - 6.0.1,8.0.1

CVE-2024-21319

Vulnerable Libraries - microsoft.identitymodel.jsonwebtokens.6.24.0.nupkg, system.identitymodel.tokens.jwt.6.24.0.nupkg

microsoft.identitymodel.jsonwebtokens.6.24.0.nupkg

Includes types that provide support for creating, serializing and validating JSON Web Tokens.

Library home page: https://api.nuget.org/packages/microsoft.identitymodel.jsonwebtokens.6.24.0.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.Workflows/OrchardCore.Workflows.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.identitymodel.jsonwebtokens/6.24.0/microsoft.identitymodel.jsonwebtokens.6.24.0.nupkg

Dependency Hierarchy:

• OrchardCore.Infrastructure-1.8.0-preview (Root Library)
  • OrchardCore.Data.YesSql-1.8.0-preview
    • yessql.3.5.0.nupkg
      • yessql.provider.sqlserver.3.5.0.nupkg
        • microsoft.data.sqlclient.5.1.2.nupkg
          • ❌ microsoft.identitymodel.jsonwebtokens.6.24.0.nupkg (Vulnerable Library)

system.identitymodel.tokens.jwt.6.24.0.nupkg

Includes types that provide support for creating, serializing and validating JSON Web Tokens.

Library home page: https://api.nuget.org/packages/system.identitymodel.tokens.jwt.6.24.0.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.Workflows/OrchardCore.Workflows.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.identitymodel.tokens.jwt/6.24.0/system.identitymodel.tokens.jwt.6.24.0.nupkg

Dependency Hierarchy:

• OrchardCore.Infrastructure-1.8.0-preview (Root Library)
  • OrchardCore.Data.YesSql-1.8.0-preview
    • yessql.3.5.0.nupkg
      • yessql.provider.sqlserver.3.5.0.nupkg
        • microsoft.data.sqlclient.5.1.2.nupkg
          • microsoft.identitymodel.protocols.openidconnect.6.24.0.nupkg
            • ❌ system.identitymodel.tokens.jwt.6.24.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Microsoft Identity Denial of service vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-21319

CVSS 3 Score Details (6.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8g9c-28fc-mcx2

Release Date: 2024-01-09

Fix Resolution: System.IdentityModel.Tokens.Jwt - 5.7.0,6.34.0,7.1.2, Microsoft.IdentityModel.JsonWebTokens - 5.7.0,6.34.0,7.1.2

CVE-2024-35255

Vulnerable Library - azure.identity.1.7.0.nupkg

This is the implementation of the Azure SDK Client Library for Azure Identity

Library home page: https://api.nuget.org/packages/azure.identity.1.7.0.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.Workflows/OrchardCore.Workflows.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/azure.identity/1.7.0/azure.identity.1.7.0.nupkg

Dependency Hierarchy:

• OrchardCore.Infrastructure-1.8.0-preview (Root Library)
  • OrchardCore.Data.YesSql-1.8.0-preview
    • yessql.3.5.0.nupkg
      • yessql.provider.sqlserver.3.5.0.nupkg
        • microsoft.data.sqlclient.5.1.2.nupkg
          • ❌ azure.identity.1.7.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Publish Date: 2024-06-11

URL: CVE-2024-35255

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m5vv-6r4h-3vj9

Release Date: 2024-06-11

Fix Resolution: @azure/identity - 4.2.1, @azure/msal-node - 2.9.1, Azure.Identity - 1.11.4, Microsoft.Identity.Client - 4.61.3, azure-identity - 1.16.1, com.azure:azure-identity:1.12.2, github.com/Azure/azure-sdk-for-go/sdk/azidentity - 1.6.0

CVE-2024-29992

Vulnerable Library - azure.identity.1.7.0.nupkg

This is the implementation of the Azure SDK Client Library for Azure Identity

Library home page: https://api.nuget.org/packages/azure.identity.1.7.0.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.Workflows/OrchardCore.Workflows.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/azure.identity/1.7.0/azure.identity.1.7.0.nupkg

Dependency Hierarchy:

• OrchardCore.Infrastructure-1.8.0-preview (Root Library)
  • OrchardCore.Data.YesSql-1.8.0-preview
    • yessql.3.5.0.nupkg
      • yessql.provider.sqlserver.3.5.0.nupkg
        • microsoft.data.sqlclient.5.1.2.nupkg
          • ❌ azure.identity.1.7.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Azure Identity Library for .NET Information Disclosure Vulnerability

Publish Date: 2024-04-09

URL: CVE-2024-29992

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wvxc-855f-jvrv

Release Date: 2024-04-09

Fix Resolution: Azure.Identity - 1.11.0

Jinja2-3.1.3-py3-none-any.whl: 1 vulnerabilities (highest severity is: 5.4) - autoclosed

Vulnerable Library - Jinja2-3.1.3-py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/30/6d/6de6be2d02603ab56e72997708809e8a5b0fbfee080735109b40a3564843/Jinja2-3.1.3-py3-none-any.whl

Path to dependency file: /src/docs/requirements.txt

Path to vulnerable library: /src/docs/requirements.txt

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (Jinja2 version)	Remediation Possible**
CVE-2024-34064	Medium	5.4	Jinja2-3.1.3-py3-none-any.whl	Direct	Jinja2 - 3.1.4	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-34064

Vulnerable Library - Jinja2-3.1.3-py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/30/6d/6de6be2d02603ab56e72997708809e8a5b0fbfee080735109b40a3564843/Jinja2-3.1.3-py3-none-any.whl

Path to dependency file: /src/docs/requirements.txt

Path to vulnerable library: /src/docs/requirements.txt

Dependency Hierarchy:

• ❌ Jinja2-3.1.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, >, or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the xmlattr filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting values as user input continues to be safe. This vulnerability is fixed in 3.1.4.

Publish Date: 2024-05-06

URL: CVE-2024-34064

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h75v-3vvj-5mfj

Release Date: 2024-05-06

Fix Resolution: Jinja2 - 3.1.4

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

serilog.aspnetcore.7.0.0.nupkg: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - serilog.aspnetcore.7.0.0.nupkg

Path to dependency file: /src/OrchardCore/OrchardCore.Logging.Serilog/OrchardCore.Logging.Serilog.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.json/7.0.0/system.text.json.7.0.0.nupkg

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (serilog.aspnetcore.7.0.0.nupkg version)	Remediation Possible**
CVE-2024-30105	High	7.5	system.text.json.7.0.0.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-30105

Vulnerable Library - system.text.json.7.0.0.nupkg

Provides high-performance and low-allocating types that serialize objects to JavaScript Object Notation (JSON) text and deserialize JSON text to objects, with UTF-8 support built-in.

Library home page: https://api.nuget.org/packages/system.text.json.7.0.0.nupkg

Path to dependency file: /src/OrchardCore/OrchardCore.Logging.Serilog/OrchardCore.Logging.Serilog.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.json/7.0.0/system.text.json.7.0.0.nupkg

Dependency Hierarchy:

• serilog.aspnetcore.7.0.0.nupkg (Root Library)
  • serilog.settings.configuration.7.0.0.nupkg
    • microsoft.extensions.dependencymodel.7.0.0.nupkg
      • ❌ system.text.json.7.0.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

.NET Core and Visual Studio Denial of Service Vulnerability

Publish Date: 2024-07-09

URL: CVE-2024-30105

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hh2w-p6rv-4g7w

Release Date: 2024-07-09

Fix Resolution: System.Text.Json - 8.0.4

OrchardCore.AuditTrail.Abstractions-1.8.0-preview: 4 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - OrchardCore.AuditTrail.Abstractions-1.8.0-preview

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (OrchardCore.AuditTrail.Abstractions version)	Remediation Possible**
CVE-2024-38095	High	7.5	system.formats.asn1.5.0.0.nupkg	Transitive	N/A*	❌
CVE-2024-30105	High	7.5	system.text.json.8.0.0.nupkg	Transitive	N/A*	❌
CVE-2019-0820	High	7.5	system.text.regularexpressions.4.3.0.nupkg	Transitive	N/A*	❌
CVE-2018-8292	Medium	5.3	system.net.http.4.3.0.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-38095

Vulnerable Library - system.formats.asn1.5.0.0.nupkg

Provides classes that can read and write the ASN.1 BER, CER, and DER data formats.

Commonly Used Ty...

Library home page: https://api.nuget.org/packages/system.formats.asn1.5.0.0.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.Workflows/OrchardCore.Workflows.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.formats.asn1/5.0.0/system.formats.asn1.5.0.0.nupkg

Dependency Hierarchy:

• OrchardCore.AuditTrail.Abstractions-1.8.0-preview (Root Library)
  • OrchardCore.ContentManagement.Display-1.8.0-preview
    • OrchardCore.DisplayManagement-1.8.0-preview
      • OrchardCore.Liquid.Abstractions-1.8.0-preview
        • fluid.core.2.5.0.nupkg
          • microsoft.extensions.fileproviders.abstractions.1.1.1.nupkg
            • microsoft.extensions.primitives.1.1.1.nupkg
              • netstandard.library.1.6.1.nupkg
                • system.security.cryptography.x509certificates.4.3.0.nupkg
                  • system.security.cryptography.cng.5.0.0.nupkg
                  • ❌ system.formats.asn1.5.0.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

.NET and Visual Studio Denial of Service Vulnerability

Publish Date: 2024-07-09

URL: CVE-2024-38095

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-447r-wph3-92pm

Release Date: 2024-07-09

Fix Resolution: Microsoft.NetCore.App.Runtime - 6.0.32,8.0.7, System.Formats.Asn1 - 6.0.1,8.0.1

CVE-2024-30105

Vulnerable Library - system.text.json.8.0.0.nupkg

Provides high-performance and low-allocating types that serialize objects to JavaScript Object Notation (JSON) text and deserialize JSON text to objects, with UTF-8 support built-in.

Library home page: https://api.nuget.org/packages/system.text.json.8.0.0.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.HomeRoute/OrchardCore.HomeRoute.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.json/8.0.0/system.text.json.8.0.0.nupkg

Dependency Hierarchy:

• OrchardCore.AuditTrail.Abstractions-1.8.0-preview (Root Library)
  • OrchardCore.ContentManagement.Display-1.8.0-preview
    • OrchardCore.DisplayManagement-1.8.0-preview
      • OrchardCore.Mvc.Core-1.8.0-preview
        • microsoft.aspnetcore.mvc.razor.runtimecompilation.8.0.0.nupkg
          • microsoft.extensions.dependencymodel.8.0.0.nupkg
            • ❌ system.text.json.8.0.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

.NET Core and Visual Studio Denial of Service Vulnerability

Publish Date: 2024-07-09

URL: CVE-2024-30105

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hh2w-p6rv-4g7w

Release Date: 2024-07-09

Fix Resolution: System.Text.Json - 8.0.4

CVE-2019-0820

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.MiniProfiler/OrchardCore.MiniProfiler.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

• OrchardCore.AuditTrail.Abstractions-1.8.0-preview (Root Library)
  • OrchardCore.ContentManagement.Display-1.8.0-preview
    • OrchardCore.DisplayManagement-1.8.0-preview
      • OrchardCore.Liquid.Abstractions-1.8.0-preview
        • fluid.core.2.5.0.nupkg
          • microsoft.extensions.fileproviders.abstractions.1.1.1.nupkg
            • microsoft.extensions.primitives.1.1.1.nupkg
              • netstandard.library.1.6.1.nupkg
                • system.xml.xdocument.4.3.0.nupkg
                  • system.xml.readerwriter.4.3.0.nupkg
                  • ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
Mend Note: After conducting further research, Mend has determined that CVE-2019-0820 only affects environments with versions 4.3.0 and 4.3.1 only on netcore50 environment of system.text.regularexpressions.nupkg.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1

CVE-2018-8292

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that allow applications to consume web services over HTTP and HTTP components that can be used by both clients and servers for parsing HTTP headers.

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.MiniProfiler/OrchardCore.MiniProfiler.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

• OrchardCore.AuditTrail.Abstractions-1.8.0-preview (Root Library)
  • OrchardCore.ContentManagement.Display-1.8.0-preview
    • OrchardCore.DisplayManagement-1.8.0-preview
      • OrchardCore.Liquid.Abstractions-1.8.0-preview
        • fluid.core.2.5.0.nupkg
          • microsoft.extensions.fileproviders.abstractions.1.1.1.nupkg
            • microsoft.extensions.primitives.1.1.1.nupkg
              • netstandard.library.1.6.1.nupkg
                • ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

azure.identity.1.10.4.nupkg: 3 vulnerabilities (highest severity is: 5.5)

Vulnerable Library - azure.identity.1.10.4.nupkg

This is the implementation of the Azure SDK Client Library for Azure Identity

Library home page: https://api.nuget.org/packages/azure.identity.1.10.4.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/azure.identity/1.10.4/azure.identity.1.10.4.nupkg

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (azure.identity.1.10.4.nupkg version)	Remediation Possible**
CVE-2024-35255	Medium	5.5	detected in multiple dependencies	Transitive	N/A*	✅
CVE-2024-29992	Medium	5.5	azure.identity.1.10.4.nupkg	Direct	Azure.Identity - 1.11.0	✅
CVE-2024-27086	Low	3.9	microsoft.identity.client.4.56.0.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-35255

Vulnerable Libraries - microsoft.identity.client.4.56.0.nupkg, azure.identity.1.10.4.nupkg

microsoft.identity.client.4.56.0.nupkg

This package contains the binaries of the Microsoft Authentication Library for .NET (MSAL.NET).

Library home page: https://api.nuget.org/packages/microsoft.identity.client.4.56.0.nupkg

Path to dependency file: /src/OrchardCore/OrchardCore.Configuration.KeyVault/OrchardCore.Configuration.KeyVault.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.identity.client/4.56.0/microsoft.identity.client.4.56.0.nupkg

Dependency Hierarchy:

• azure.identity.1.10.4.nupkg (Root Library)
  • ❌ microsoft.identity.client.4.56.0.nupkg (Vulnerable Library)

azure.identity.1.10.4.nupkg

This is the implementation of the Azure SDK Client Library for Azure Identity

Library home page: https://api.nuget.org/packages/azure.identity.1.10.4.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/azure.identity/1.10.4/azure.identity.1.10.4.nupkg

Dependency Hierarchy:

• ❌ azure.identity.1.10.4.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Publish Date: 2024-06-11

URL: CVE-2024-35255

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m5vv-6r4h-3vj9

Release Date: 2024-06-11

Fix Resolution: @azure/identity - 4.2.1, @azure/msal-node - 2.9.1, Azure.Identity - 1.11.4, Microsoft.Identity.Client - 4.61.3, azure-identity - 1.16.1, com.azure:azure-identity:1.12.2, github.com/Azure/azure-sdk-for-go/sdk/azidentity - 1.6.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-29992

Vulnerable Library - azure.identity.1.10.4.nupkg

This is the implementation of the Azure SDK Client Library for Azure Identity

Library home page: https://api.nuget.org/packages/azure.identity.1.10.4.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/azure.identity/1.10.4/azure.identity.1.10.4.nupkg

Dependency Hierarchy:

• ❌ azure.identity.1.10.4.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Azure Identity Library for .NET Information Disclosure Vulnerability

Publish Date: 2024-04-09

URL: CVE-2024-29992

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wvxc-855f-jvrv

Release Date: 2024-04-09

Fix Resolution: Azure.Identity - 1.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-27086

Vulnerable Library - microsoft.identity.client.4.56.0.nupkg

This package contains the binaries of the Microsoft Authentication Library for .NET (MSAL.NET).

Library home page: https://api.nuget.org/packages/microsoft.identity.client.4.56.0.nupkg

Path to dependency file: /src/OrchardCore/OrchardCore.Configuration.KeyVault/OrchardCore.Configuration.KeyVault.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.identity.client/4.56.0/microsoft.identity.client.4.56.0.nupkg

Dependency Hierarchy:

• azure.identity.1.10.4.nupkg (Root Library)
  • ❌ microsoft.identity.client.4.56.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability.
A malicious application running on a customer Android device can cause local denial of service against applications that were built using MSAL.NET for authentication on the same device (i.e., prevent the user of the legitimate application from logging in) due to incorrect activity export configuration. MSAL.NET version 4.60.1 includes the fix. As a workaround, a developer may explicitly mark the MSAL.NET activity non-exported.

Publish Date: 2024-04-16

URL: CVE-2024-27086

CVSS 3 Score Details (3.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-x674-v45j-fwxw

Release Date: 2024-04-16

Fix Resolution: Microsoft.Identity.Client - 4.59.1,4.60.3

---

⛑️Automatic Remediation will be attempted for this issue.

Jinja2-3.1.2-py3-none-any.whl: 1 vulnerabilities (highest severity is: 6.1) - autoclosed

Vulnerable Library - Jinja2-3.1.2-py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/bc/c3/f068337a370801f372f2f8f6bad74a5c140f6fda3d9de154052708dd3c65/Jinja2-3.1.2-py3-none-any.whl

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (Jinja2 version)	Remediation Possible**
CVE-2024-22195	Medium	6.1	Jinja2-3.1.2-py3-none-any.whl	Direct	jinja2 - 3.1.3	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-22195

Vulnerable Library - Jinja2-3.1.2-py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/bc/c3/f068337a370801f372f2f8f6bad74a5c140f6fda3d9de154052708dd3c65/Jinja2-3.1.2-py3-none-any.whl

Dependency Hierarchy:

• ❌ Jinja2-3.1.2-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja xmlattr filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.

Publish Date: 2024-01-11

URL: CVE-2024-22195

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h5c8-rqwp-cp95

Release Date: 2024-01-11

Fix Resolution: jinja2 - 3.1.3

OrchardCore.Application.Cms.Targets-1.8.0-preview: 8 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - OrchardCore.Application.Cms.Targets-1.8.0-preview

Path to vulnerable library: /home/wss-scanner/.nuget/packages/bouncycastle.cryptography/2.2.1/bouncycastle.cryptography.2.2.1.nupkg

Found in HEAD commit: 5279d43f2d4b5305c13128b14818d8a6bf21f5e0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (OrchardCore.Application.Cms.Targets version)	Remediation Possible**
CVE-2024-41131	High	7.5	sixlabors.imagesharp.3.0.1.nupkg	Transitive	N/A*	❌
CVE-2024-29857	High	7.5	bouncycastle.cryptography.2.2.1.nupkg	Transitive	N/A*	❌
CVE-2024-27929	High	7.1	sixlabors.imagesharp.3.0.1.nupkg	Transitive	N/A*	❌
CVE-2024-30172	Medium	5.9	bouncycastle.cryptography.2.2.1.nupkg	Transitive	N/A*	❌
CVE-2024-30171	Medium	5.9	bouncycastle.cryptography.2.2.1.nupkg	Transitive	N/A*	❌
CVE-2024-41132	Medium	5.3	sixlabors.imagesharp.3.0.1.nupkg	Transitive	N/A*	❌
CVE-2024-32036	Medium	5.3	sixlabors.imagesharp.3.0.1.nupkg	Transitive	N/A*	❌
CVE-2024-32035	Medium	5.3	sixlabors.imagesharp.3.0.1.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-41131

Vulnerable Library - sixlabors.imagesharp.3.0.1.nupkg

A new, fully featured, fully managed, cross-platform, 2D graphics API for .NET

Library home page: https://api.nuget.org/packages/sixlabors.imagesharp.3.0.1.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/sixlabors.imagesharp/3.0.1/sixlabors.imagesharp.3.0.1.nupkg

Dependency Hierarchy:

• OrchardCore.Application.Cms.Targets-1.8.0-preview (Root Library)
  • OrchardCore.Application.Cms.Core.Targets-1.8.0-preview
    • OrchardCore.Media-1.8.0-preview
      • SixLabors.ImageSharp.Web-3.0.1
        • ❌ sixlabors.imagesharp.3.0.1.nupkg (Vulnerable Library)

Found in HEAD commit: 5279d43f2d4b5305c13128b14818d8a6bf21f5e0

Found in base branch: main

Vulnerability Details

ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. All users are advised to upgrade to v3.1.5 or v2.1.9.

Publish Date: 2024-07-22

URL: CVE-2024-41131

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-63p8-c4ww-9cg7

Release Date: 2024-07-22

Fix Resolution: SixLabors.ImageSharp - 2.1.9,3.1.5

CVE-2024-29857

Vulnerable Library - bouncycastle.cryptography.2.2.1.nupkg

BouncyCastle.NET is a popular cryptography library for .NET

Library home page: https://api.nuget.org/packages/bouncycastle.cryptography.2.2.1.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.Notifications/OrchardCore.Notifications.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/bouncycastle.cryptography/2.2.1/bouncycastle.cryptography.2.2.1.nupkg

Dependency Hierarchy:

• OrchardCore.Application.Cms.Targets-1.8.0-preview (Root Library)
  • OrchardCore.Application.Cms.Core.Targets-1.8.0-preview
    • OrchardCore.Email-1.8.0-preview
      • OrchardCore.Email.Core-1.8.0-preview
        • mailkit.4.3.0.nupkg
          • mimekit.4.3.0.nupkg
            • ❌ bouncycastle.cryptography.2.2.1.nupkg (Vulnerable Library)

Found in HEAD commit: 5279d43f2d4b5305c13128b14818d8a6bf21f5e0

Found in base branch: main

Vulnerability Details

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Publish Date: 2024-05-14

URL: CVE-2024-29857

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8xfc-gm6g-vgpv

Release Date: 2024-05-14

Fix Resolution: org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78, BouncyCastle.Cryptography - 2.3.1

CVE-2024-27929

Vulnerable Library - sixlabors.imagesharp.3.0.1.nupkg

A new, fully featured, fully managed, cross-platform, 2D graphics API for .NET

Library home page: https://api.nuget.org/packages/sixlabors.imagesharp.3.0.1.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/sixlabors.imagesharp/3.0.1/sixlabors.imagesharp.3.0.1.nupkg

Dependency Hierarchy:

• OrchardCore.Application.Cms.Targets-1.8.0-preview (Root Library)
  • OrchardCore.Application.Cms.Core.Targets-1.8.0-preview
    • OrchardCore.Media-1.8.0-preview
      • SixLabors.ImageSharp.Web-3.0.1
        • ❌ sixlabors.imagesharp.3.0.1.nupkg (Vulnerable Library)

Found in HEAD commit: 5279d43f2d4b5305c13128b14818d8a6bf21f5e0

Found in base branch: main

Vulnerability Details

ImageSharp is a managed, cross-platform, 2D graphics library. A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure. This issue has been patched in versions 3.1.3 and 2.1.7.

Publish Date: 2024-03-05

URL: CVE-2024-27929

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-65x7-c272-7g7r

Release Date: 2024-03-05

Fix Resolution: SixLabors.ImageSharp - 2.1.7,3.1.3

CVE-2024-30172

Vulnerable Library - bouncycastle.cryptography.2.2.1.nupkg

BouncyCastle.NET is a popular cryptography library for .NET

Library home page: https://api.nuget.org/packages/bouncycastle.cryptography.2.2.1.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.Notifications/OrchardCore.Notifications.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/bouncycastle.cryptography/2.2.1/bouncycastle.cryptography.2.2.1.nupkg

Dependency Hierarchy:

• OrchardCore.Application.Cms.Targets-1.8.0-preview (Root Library)
  • OrchardCore.Application.Cms.Core.Targets-1.8.0-preview
    • OrchardCore.Email-1.8.0-preview
      • OrchardCore.Email.Core-1.8.0-preview
        • mailkit.4.3.0.nupkg
          • mimekit.4.3.0.nupkg
            • ❌ bouncycastle.cryptography.2.2.1.nupkg (Vulnerable Library)

Found in HEAD commit: 5279d43f2d4b5305c13128b14818d8a6bf21f5e0

Found in base branch: main

Vulnerability Details

An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.

Publish Date: 2024-05-09

URL: CVE-2024-30172

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2024-30172

Release Date: 2024-03-24

Fix Resolution: org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk14:1.78

CVE-2024-30171

Vulnerable Library - bouncycastle.cryptography.2.2.1.nupkg

BouncyCastle.NET is a popular cryptography library for .NET

Library home page: https://api.nuget.org/packages/bouncycastle.cryptography.2.2.1.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.Notifications/OrchardCore.Notifications.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/bouncycastle.cryptography/2.2.1/bouncycastle.cryptography.2.2.1.nupkg

Dependency Hierarchy:

• OrchardCore.Application.Cms.Targets-1.8.0-preview (Root Library)
  • OrchardCore.Application.Cms.Core.Targets-1.8.0-preview
    • OrchardCore.Email-1.8.0-preview
      • OrchardCore.Email.Core-1.8.0-preview
        • mailkit.4.3.0.nupkg
          • mimekit.4.3.0.nupkg
            • ❌ bouncycastle.cryptography.2.2.1.nupkg (Vulnerable Library)

Found in HEAD commit: 5279d43f2d4b5305c13128b14818d8a6bf21f5e0

Found in base branch: main

Vulnerability Details

An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.

Publish Date: 2024-05-09

URL: CVE-2024-30171

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v435-xc8x-wvr9

Release Date: 2024-05-09

Fix Resolution: org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78, BouncyCastle.Cryptography - 2.3.1

CVE-2024-41132

Vulnerable Library - sixlabors.imagesharp.3.0.1.nupkg

A new, fully featured, fully managed, cross-platform, 2D graphics API for .NET

Library home page: https://api.nuget.org/packages/sixlabors.imagesharp.3.0.1.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/sixlabors.imagesharp/3.0.1/sixlabors.imagesharp.3.0.1.nupkg

Dependency Hierarchy:

• OrchardCore.Application.Cms.Targets-1.8.0-preview (Root Library)
  • OrchardCore.Application.Cms.Core.Targets-1.8.0-preview
    • OrchardCore.Media-1.8.0-preview
      • SixLabors.ImageSharp.Web-3.0.1
        • ❌ sixlabors.imagesharp.3.0.1.nupkg (Vulnerable Library)

Found in HEAD commit: 5279d43f2d4b5305c13128b14818d8a6bf21f5e0

Found in base branch: main

Vulnerability Details

ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. All users are advised to upgrade to v3.1.5 or v2.1.9.

Publish Date: 2024-07-22

URL: CVE-2024-41132

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-41132

Release Date: 2024-07-22

Fix Resolution: SixLabors.ImageSharp - 2.1.9,3.1.5

CVE-2024-32036

Vulnerable Library - sixlabors.imagesharp.3.0.1.nupkg

A new, fully featured, fully managed, cross-platform, 2D graphics API for .NET

Library home page: https://api.nuget.org/packages/sixlabors.imagesharp.3.0.1.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/sixlabors.imagesharp/3.0.1/sixlabors.imagesharp.3.0.1.nupkg

Dependency Hierarchy:

• OrchardCore.Application.Cms.Targets-1.8.0-preview (Root Library)
  • OrchardCore.Application.Cms.Core.Targets-1.8.0-preview
    • OrchardCore.Media-1.8.0-preview
      • SixLabors.ImageSharp.Web-3.0.1
        • ❌ sixlabors.imagesharp.3.0.1.nupkg (Vulnerable Library)

Found in HEAD commit: 5279d43f2d4b5305c13128b14818d8a6bf21f5e0

Found in base branch: main

Vulnerability Details

ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8.

Publish Date: 2024-04-15

URL: CVE-2024-32036

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5x7m-6737-26cr

Release Date: 2024-04-15

Fix Resolution: SixLabors.ImageSharp - 2.1.8,3.1.4

CVE-2024-32035

Vulnerable Library - sixlabors.imagesharp.3.0.1.nupkg

A new, fully featured, fully managed, cross-platform, 2D graphics API for .NET

Library home page: https://api.nuget.org/packages/sixlabors.imagesharp.3.0.1.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/sixlabors.imagesharp/3.0.1/sixlabors.imagesharp.3.0.1.nupkg

Dependency Hierarchy:

• OrchardCore.Application.Cms.Targets-1.8.0-preview (Root Library)
  • OrchardCore.Application.Cms.Core.Targets-1.8.0-preview
    • OrchardCore.Media-1.8.0-preview
      • SixLabors.ImageSharp.Web-3.0.1
        • ❌ sixlabors.imagesharp.3.0.1.nupkg (Vulnerable Library)

Found in HEAD commit: 5279d43f2d4b5305c13128b14818d8a6bf21f5e0

Found in base branch: main

Vulnerability Details

ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. This flaw can be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on ImageSharp for image processing tasks. Users and administrators are advised to update to the latest version of ImageSharp that addresses this vulnerability to mitigate the risk of exploitation. The problem has been patched in v3.1.4 and v2.1.8.

Publish Date: 2024-04-15

URL: CVE-2024-32035

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-g85r-6x2q-45w7

Release Date: 2024-04-15

Fix Resolution: SixLabors.ImageSharp - 2.1.8,3.1.4

zipp-3.15.0-py3-none-any.whl: 1 vulnerabilities (highest severity is: 3.3)

Vulnerable Library - zipp-3.15.0-py3-none-any.whl

Backport of pathlib-compatible object wrapper for zip files

Library home page: https://files.pythonhosted.org/packages/5b/fa/c9e82bbe1af6266adf08afb563905eb87cab83fde00a0a08963510621047/zipp-3.15.0-py3-none-any.whl

Path to dependency file: /src/docs/requirements.txt

Path to vulnerable library: /src/docs/requirements.txt

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (zipp version)	Remediation Possible**
CVE-2024-5569	Low	3.3	zipp-3.15.0-py3-none-any.whl	Direct	3.19.1	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-5569

Vulnerable Library - zipp-3.15.0-py3-none-any.whl

Backport of pathlib-compatible object wrapper for zip files

Library home page: https://files.pythonhosted.org/packages/5b/fa/c9e82bbe1af6266adf08afb563905eb87cab83fde00a0a08963510621047/zipp-3.15.0-py3-none-any.whl

Path to dependency file: /src/docs/requirements.txt

Path to vulnerable library: /src/docs/requirements.txt

Dependency Hierarchy:

• ❌ zipp-3.15.0-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

Publish Date: 2024-07-09

URL: CVE-2024-5569

CVSS 3 Score Details (3.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae

Release Date: 2024-07-09

Fix Resolution: 3.19.1

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

Code Security Report: 16 high severity findings, 19 total findings

Code Security Report

Scan Metadata

Latest Scan: 2024-06-25 07:00am
Total Findings: 19 | New Findings: 0 | Resolved Findings: 0
Tested Project Files: 6067
Detected Programming Languages: 3 (JavaScript / TypeScript*, C#*, PHP)

• Check this box to manually trigger a scan

Most Relevant Findings

The list below presents the 8 most relevant findings that need your attention. To view information on the remaining findings, navigate to the Mend Application.

Severity	Vulnerability Type	CWE	File	Data Flows	Date
High	Path/Directory Traversal	CWE-22	DefaultSitemapCacheProvider.cs:148	1	2024-05-19 03:18pm
Vulnerable Code OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Sitemaps/Cache/DefaultSitemapCacheProvider.cs Lines 143 to 148 in c28aece var fileInfo = _fileProvider.GetFileInfo(cacheFileName); if (fileInfo.Exists) { try { File.Delete(fileInfo.PhysicalPath); 1 Data Flow/s detected OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Sitemaps/Controllers/SitemapCacheController.cs Line 70 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Sitemaps/Controllers/SitemapCacheController.cs Line 78 in c28aece var failed = await _sitemapCacheProvider.PurgeAsync(cacheFileName); OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Sitemaps/Cache/DefaultSitemapCacheProvider.cs Line 140 in c28aece public Task<bool> PurgeAsync(string cacheFileName) OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Sitemaps/Cache/DefaultSitemapCacheProvider.cs Line 143 in c28aece var fileInfo = _fileProvider.GetFileInfo(cacheFileName); OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Sitemaps/Cache/DefaultSitemapCacheProvider.cs Line 148 in c28aece File.Delete(fileInfo.PhysicalPath); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet
High	Path/Directory Traversal	CWE-22	LuceneIndexManager.cs:138	9	2024-05-19 03:18pm
Vulnerable Code OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Lines 133 to 138 in c28aece if (string.IsNullOrWhiteSpace(indexName)) { return false; } return Directory.Exists(PathExtensions.Combine(_rootPath, indexName)); 9 Data Flow/s detected View Data Flow 1 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 258 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 270 in c28aece if (!_luceneIndexManager.Exists(id)) OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 131 in c28aece public bool Exists(string indexName) OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 138 in c28aece return Directory.Exists(PathExtensions.Combine(_rootPath, indexName)); OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 17 in c28aece public static string Combine(string path, string other = null) OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 27 in c28aece return other; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 138 in c28aece return Directory.Exists(PathExtensions.Combine(_rootPath, indexName)); View Data Flow 2 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 287 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 299 in c28aece await _luceneIndexingService.RebuildIndexAsync(id); OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexingService.cs Line 288 in c28aece public async Task RebuildIndexAsync(string indexName) OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexingService.cs Line 290 in c28aece if (_indexManager.Exists(indexName)) OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 131 in c28aece public bool Exists(string indexName) OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 138 in c28aece return Directory.Exists(PathExtensions.Combine(_rootPath, indexName)); OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 17 in c28aece public static string Combine(string path, string other = null) OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 27 in c28aece return other; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 138 in c28aece return Directory.Exists(PathExtensions.Combine(_rootPath, indexName)); View Data Flow 3 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 350 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 371 in c28aece if (!_luceneIndexManager.Exists(model.IndexName)) OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/ViewModels/AdminQueryViewModel.cs Line 12 in c28aece public string IndexName { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 371 in c28aece if (!_luceneIndexManager.Exists(model.IndexName)) OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 131 in c28aece public bool Exists(string indexName) OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 138 in c28aece return Directory.Exists(PathExtensions.Combine(_rootPath, indexName)); OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 17 in c28aece public static string Combine(string path, string other = null) OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 27 in c28aece return other; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 138 in c28aece return Directory.Exists(PathExtensions.Combine(_rootPath, indexName)); View more Data Flows Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet
High	Path/Directory Traversal	CWE-22	ShellConfigurationSources.cs:61	4	2024-06-13 04:40am
Vulnerable Code OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Lines 56 to 61 in c28aece } } Directory.CreateDirectory(tenantFolder); using var streamWriter = File.CreateText(appsettings); 4 Data Flow/s detected View Data Flow 1 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/ApiController.cs Line 87 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/ApiController.cs Line 113 in c28aece shellSettings.Name = model.Name; OrchardCore_Demo/src/OrchardCore/OrchardCore.Abstractions/Shell/ShellSettings.cs Line 65 in c28aece public string Name { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/ApiController.cs Line 127 in c28aece await _shellHost.UpdateShellSettingsAsync(shellSettings); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/ShellHost.cs Line 158 in c28aece public async Task UpdateShellSettingsAsync(ShellSettings settings) View remaining steps OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 31 in c28aece public async Task SaveAsync(string tenant, IDictionary<string, string> data) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 33 in c28aece var tenantFolder = Path.Combine(_container, tenant); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 34 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 37 in c28aece if (File.Exists(appsettings)) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 61 in c28aece using var streamWriter = File.CreateText(appsettings); View Data Flow 2 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/AdminController.cs Line 333 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/AdminController.cs Line 359 in c28aece shellSettings.Name = model.Name; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Models/TenantModelBase.cs Line 12 in c28aece public string Name { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/AdminController.cs Line 359 in c28aece shellSettings.Name = model.Name; OrchardCore_Demo/src/OrchardCore/OrchardCore.Abstractions/Shell/ShellSettings.cs Line 65 in c28aece public string Name { get; set; } View remaining steps OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 31 in c28aece public async Task SaveAsync(string tenant, IDictionary<string, string> data) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 33 in c28aece var tenantFolder = Path.Combine(_container, tenant); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 34 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 37 in c28aece if (File.Exists(appsettings)) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 61 in c28aece using var streamWriter = File.CreateText(appsettings); View Data Flow 3 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 92 in c28aece [HttpPost, ActionName("Index")] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 156 in c28aece { SetupConstants.SiteTimeZone, model.SiteTimeZone }, OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/ViewModels/SetupViewModel.cs Line 55 in c28aece public string SiteTimeZone { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 156 in c28aece { SetupConstants.SiteTimeZone, model.SiteTimeZone }, OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 150 in c28aece Properties = new Dictionary<string, object> View remaining steps OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 31 in c28aece public async Task SaveAsync(string tenant, IDictionary<string, string> data) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 33 in c28aece var tenantFolder = Path.Combine(_container, tenant); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 34 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 37 in c28aece if (File.Exists(appsettings)) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 61 in c28aece using var streamWriter = File.CreateText(appsettings); View more Data Flows Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet
High	Path/Directory Traversal	CWE-22	ShellConfigurationSources.cs:37	4	2024-06-13 04:40am
Vulnerable Code OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Lines 32 to 37 in c28aece { var tenantFolder = Path.Combine(_container, tenant); var appsettings = Path.Combine(tenantFolder, "appsettings.json"); IDictionary<string, string> configData; if (File.Exists(appsettings)) 4 Data Flow/s detected View Data Flow 1 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/ApiController.cs Line 87 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/ApiController.cs Line 113 in c28aece shellSettings.Name = model.Name; OrchardCore_Demo/src/OrchardCore/OrchardCore.Abstractions/Shell/ShellSettings.cs Line 65 in c28aece public string Name { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/ApiController.cs Line 127 in c28aece await _shellHost.UpdateShellSettingsAsync(shellSettings); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/ShellHost.cs Line 158 in c28aece public async Task UpdateShellSettingsAsync(ShellSettings settings) View remaining steps OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/ShellSettingsManager.cs Line 205 in c28aece await _tenantConfigSources.SaveAsync(settings.Name, tenantConfig); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 31 in c28aece public async Task SaveAsync(string tenant, IDictionary<string, string> data) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 33 in c28aece var tenantFolder = Path.Combine(_container, tenant); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 34 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 37 in c28aece if (File.Exists(appsettings)) View Data Flow 2 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/AdminController.cs Line 333 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/AdminController.cs Line 359 in c28aece shellSettings.Name = model.Name; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Models/TenantModelBase.cs Line 12 in c28aece public string Name { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/AdminController.cs Line 359 in c28aece shellSettings.Name = model.Name; OrchardCore_Demo/src/OrchardCore/OrchardCore.Abstractions/Shell/ShellSettings.cs Line 65 in c28aece public string Name { get; set; } View remaining steps OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/ShellSettingsManager.cs Line 205 in c28aece await _tenantConfigSources.SaveAsync(settings.Name, tenantConfig); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 31 in c28aece public async Task SaveAsync(string tenant, IDictionary<string, string> data) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 33 in c28aece var tenantFolder = Path.Combine(_container, tenant); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 34 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 37 in c28aece if (File.Exists(appsettings)) View Data Flow 3 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 92 in c28aece [HttpPost, ActionName("Index")] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 156 in c28aece { SetupConstants.SiteTimeZone, model.SiteTimeZone }, OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/ViewModels/SetupViewModel.cs Line 55 in c28aece public string SiteTimeZone { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 156 in c28aece { SetupConstants.SiteTimeZone, model.SiteTimeZone }, OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 150 in c28aece Properties = new Dictionary<string, object> View remaining steps OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/ShellSettingsManager.cs Line 205 in c28aece await _tenantConfigSources.SaveAsync(settings.Name, tenantConfig); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 31 in c28aece public async Task SaveAsync(string tenant, IDictionary<string, string> data) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 33 in c28aece var tenantFolder = Path.Combine(_container, tenant); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 34 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 37 in c28aece if (File.Exists(appsettings)) View more Data Flows Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet
High	Path/Directory Traversal	CWE-22	ShellConfigurationSources.cs:59	4	2024-06-13 04:40am
Vulnerable Code OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Lines 54 to 59 in c28aece { configData.Remove(key); } } Directory.CreateDirectory(tenantFolder); 4 Data Flow/s detected View Data Flow 1 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/ApiController.cs Line 87 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/ApiController.cs Line 113 in c28aece shellSettings.Name = model.Name; OrchardCore_Demo/src/OrchardCore/OrchardCore.Abstractions/Shell/ShellSettings.cs Line 65 in c28aece public string Name { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/ApiController.cs Line 127 in c28aece await _shellHost.UpdateShellSettingsAsync(shellSettings); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/ShellHost.cs Line 158 in c28aece public async Task UpdateShellSettingsAsync(ShellSettings settings) View remaining steps OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/ShellSettingsManager.cs Line 205 in c28aece await _tenantConfigSources.SaveAsync(settings.Name, tenantConfig); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 31 in c28aece public async Task SaveAsync(string tenant, IDictionary<string, string> data) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 33 in c28aece var tenantFolder = Path.Combine(_container, tenant); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 34 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 59 in c28aece Directory.CreateDirectory(tenantFolder); View Data Flow 2 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/AdminController.cs Line 333 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/AdminController.cs Line 359 in c28aece shellSettings.Name = model.Name; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Models/TenantModelBase.cs Line 12 in c28aece public string Name { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/AdminController.cs Line 359 in c28aece shellSettings.Name = model.Name; OrchardCore_Demo/src/OrchardCore/OrchardCore.Abstractions/Shell/ShellSettings.cs Line 65 in c28aece public string Name { get; set; } View remaining steps OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/ShellSettingsManager.cs Line 205 in c28aece await _tenantConfigSources.SaveAsync(settings.Name, tenantConfig); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 31 in c28aece public async Task SaveAsync(string tenant, IDictionary<string, string> data) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 33 in c28aece var tenantFolder = Path.Combine(_container, tenant); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 34 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 59 in c28aece Directory.CreateDirectory(tenantFolder); View Data Flow 3 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 92 in c28aece [HttpPost, ActionName("Index")] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 156 in c28aece { SetupConstants.SiteTimeZone, model.SiteTimeZone }, OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/ViewModels/SetupViewModel.cs Line 55 in c28aece public string SiteTimeZone { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 156 in c28aece { SetupConstants.SiteTimeZone, model.SiteTimeZone }, OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 150 in c28aece Properties = new Dictionary<string, object> View remaining steps OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/ShellSettingsManager.cs Line 205 in c28aece await _tenantConfigSources.SaveAsync(settings.Name, tenantConfig); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 31 in c28aece public async Task SaveAsync(string tenant, IDictionary<string, string> data) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 33 in c28aece var tenantFolder = Path.Combine(_container, tenant); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 34 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 59 in c28aece Directory.CreateDirectory(tenantFolder); View more Data Flows Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet
High	Path/Directory Traversal	CWE-22	ShellConfigurationSources.cs:39	4	2024-06-13 04:40am
Vulnerable Code OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Lines 34 to 39 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); IDictionary<string, string> configData; if (File.Exists(appsettings)) { using var stream = File.OpenRead(appsettings); 4 Data Flow/s detected View Data Flow 1 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/ApiController.cs Line 87 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/ApiController.cs Line 113 in c28aece shellSettings.Name = model.Name; OrchardCore_Demo/src/OrchardCore/OrchardCore.Abstractions/Shell/ShellSettings.cs Line 65 in c28aece public string Name { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/ApiController.cs Line 127 in c28aece await _shellHost.UpdateShellSettingsAsync(shellSettings); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/ShellHost.cs Line 158 in c28aece public async Task UpdateShellSettingsAsync(ShellSettings settings) View remaining steps OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 31 in c28aece public async Task SaveAsync(string tenant, IDictionary<string, string> data) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 33 in c28aece var tenantFolder = Path.Combine(_container, tenant); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 34 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 37 in c28aece if (File.Exists(appsettings)) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 39 in c28aece using var stream = File.OpenRead(appsettings); View Data Flow 2 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/AdminController.cs Line 333 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/AdminController.cs Line 359 in c28aece shellSettings.Name = model.Name; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Models/TenantModelBase.cs Line 12 in c28aece public string Name { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Tenants/Controllers/AdminController.cs Line 359 in c28aece shellSettings.Name = model.Name; OrchardCore_Demo/src/OrchardCore/OrchardCore.Abstractions/Shell/ShellSettings.cs Line 65 in c28aece public string Name { get; set; } View remaining steps OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 31 in c28aece public async Task SaveAsync(string tenant, IDictionary<string, string> data) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 33 in c28aece var tenantFolder = Path.Combine(_container, tenant); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 34 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 37 in c28aece if (File.Exists(appsettings)) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 39 in c28aece using var stream = File.OpenRead(appsettings); View Data Flow 3 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 92 in c28aece [HttpPost, ActionName("Index")] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 156 in c28aece { SetupConstants.SiteTimeZone, model.SiteTimeZone }, OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/ViewModels/SetupViewModel.cs Line 55 in c28aece public string SiteTimeZone { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 156 in c28aece { SetupConstants.SiteTimeZone, model.SiteTimeZone }, OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Setup/Controllers/SetupController.cs Line 150 in c28aece Properties = new Dictionary<string, object> View remaining steps OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 31 in c28aece public async Task SaveAsync(string tenant, IDictionary<string, string> data) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 33 in c28aece var tenantFolder = Path.Combine(_container, tenant); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 34 in c28aece var appsettings = Path.Combine(tenantFolder, "appsettings.json"); OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 37 in c28aece if (File.Exists(appsettings)) OrchardCore_Demo/src/OrchardCore/OrchardCore/Shell/Configuration/ShellConfigurationSources.cs Line 39 in c28aece using var stream = File.OpenRead(appsettings); View more Data Flows Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet
High	Path/Directory Traversal	CWE-22	LuceneIndexManager.cs:373	2	2024-05-19 03:18pm
Vulnerable Code OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Lines 368 to 373 in c28aece { var path = new DirectoryInfo(PathExtensions.Combine(_rootPath, indexName)); if (!path.Exists) { path.Create(); 2 Data Flow/s detected View Data Flow 1 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 287 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 299 in c28aece await _luceneIndexingService.RebuildIndexAsync(id); OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexingService.cs Line 288 in c28aece public async Task RebuildIndexAsync(string indexName) OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexingService.cs Line 295 in c28aece await _indexManager.CreateIndexAsync(indexName); OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 78 in c28aece public async Task CreateIndexAsync(string indexName) View remaining steps OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 369 in c28aece var path = new DirectoryInfo(PathExtensions.Combine(_rootPath, indexName)); OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 17 in c28aece public static string Combine(string path, string other = null) OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 27 in c28aece return other; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 369 in c28aece var path = new DirectoryInfo(PathExtensions.Combine(_rootPath, indexName)); OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 373 in c28aece path.Create(); View Data Flow 2 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 184 in c28aece [HttpPost, ActionName("Edit")] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 222 in c28aece var settings = new LuceneIndexSettings { IndexName = model.IndexName, AnalyzerName = model.AnalyzerName, IndexLatest = model.IndexLatest, IndexedContentTypes = indexedContentTypes, Culture = model.Culture ?? "", StoreSourceData = model.StoreSourceData }; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Model/LuceneIndexSettings.cs Line 16 in c28aece public string[] IndexedContentTypes { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 226 in c28aece await _luceneIndexingService.CreateIndexAsync(settings); OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexingService.cs Line 246 in c28aece public async Task CreateIndexAsync(LuceneIndexSettings indexSettings) View remaining steps OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 369 in c28aece var path = new DirectoryInfo(PathExtensions.Combine(_rootPath, indexName)); OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 17 in c28aece public static string Combine(string path, string other = null) OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 27 in c28aece return other; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 369 in c28aece var path = new DirectoryInfo(PathExtensions.Combine(_rootPath, indexName)); OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 373 in c28aece path.Create(); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet
High	Path/Directory Traversal	CWE-22	LuceneIndexManager.cs:430	5	2024-05-19 03:18pm
Vulnerable Code OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Lines 425 to 430 in c28aece private IndexReaderPool.IndexReaderLease GetReader(string indexName) { var pool = _indexPools.GetOrAdd(indexName, n => { var path = new DirectoryInfo(PathExtensions.Combine(_rootPath, indexName)); 5 Data Flow/s detected View Data Flow 1 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 350 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 389 in c28aece await _luceneIndexManager.SearchAsync(model.IndexName, async searcher => OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/ViewModels/AdminQueryViewModel.cs Line 12 in c28aece public string IndexName { get; set; } OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/AdminController.cs Line 389 in c28aece await _luceneIndexManager.SearchAsync(model.IndexName, async searcher => OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 162 in c28aece public async Task SearchAsync(string indexName, Func<IndexSearcher, Task> searcher) View remaining steps OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 428 in c28aece var pool = _indexPools.GetOrAdd(indexName, n => OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 430 in c28aece var path = new DirectoryInfo(PathExtensions.Combine(_rootPath, indexName)); OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 17 in c28aece public static string Combine(string path, string other = null) OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 27 in c28aece return other; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 430 in c28aece var path = new DirectoryInfo(PathExtensions.Combine(_rootPath, indexName)); View Data Flow 2 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/ApiController.cs Line 26 in c28aece [HttpGet] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/ApiController.cs Line 35 in c28aece var result = await LuceneQueryApiAsync(queryModel, returnContentItems: true); OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/ApiController.cs Line 82 in c28aece private Task<Queries.IQueryResults> LuceneQueryApiAsync(LuceneQueryModel queryModel, bool returnContentItems = false) OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/ApiController.cs Line 86 in c28aece Index = queryModel.IndexName, OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Model/LuceneQueryModel.cs Line 5 in c28aece public string IndexName { set; get; } View remaining steps OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 428 in c28aece var pool = _indexPools.GetOrAdd(indexName, n => OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 430 in c28aece var path = new DirectoryInfo(PathExtensions.Combine(_rootPath, indexName)); OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 17 in c28aece public static string Combine(string path, string other = null) OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 27 in c28aece return other; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 430 in c28aece var path = new DirectoryInfo(PathExtensions.Combine(_rootPath, indexName)); View Data Flow 3 OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/ApiController.cs Line 40 in c28aece [HttpPost] OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/ApiController.cs Line 49 in c28aece var result = await LuceneQueryApiAsync(queryModel, returnContentItems: true); OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/ApiController.cs Line 82 in c28aece private Task<Queries.IQueryResults> LuceneQueryApiAsync(LuceneQueryModel queryModel, bool returnContentItems = false) OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Controllers/ApiController.cs Line 86 in c28aece Index = queryModel.IndexName, OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Model/LuceneQueryModel.cs Line 5 in c28aece public string IndexName { set; get; } View remaining steps OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 428 in c28aece var pool = _indexPools.GetOrAdd(indexName, n => OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 430 in c28aece var path = new DirectoryInfo(PathExtensions.Combine(_rootPath, indexName)); OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 17 in c28aece public static string Combine(string path, string other = null) OrchardCore_Demo/src/OrchardCore/OrchardCore.Infrastructure.Abstractions/Files/PathExtensions.cs Line 27 in c28aece return other; OrchardCore_Demo/src/OrchardCore.Modules/OrchardCore.Search.Lucene/Services/LuceneIndexManager.cs Line 430 in c28aece var path = new DirectoryInfo(PathExtensions.Combine(_rootPath, indexName)); View more Data Flows Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet

Findings Overview

Severity	Vulnerability Type	CWE	Language	Count
High	Path/Directory Traversal	CWE-22	C#*	11
High	Deserialization of Untrusted Data	CWE-502	C#*	5
Medium	Error Messages Information Exposure	CWE-209	C#*	2
Low	Sensitive Cookie Without Secure	CWE-614	C#*	1

OrchardCore.ContentFields-1.8.0-preview: 6 vulnerabilities (highest severity is: 8.7)

Vulnerable Library - OrchardCore.ContentFields-1.8.0-preview

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.data.sqlclient/5.1.2/microsoft.data.sqlclient.5.1.2.nupkg

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (OrchardCore.ContentFields version)	Remediation Possible**
CVE-2024-0056	High	8.7	microsoft.data.sqlclient.5.1.2.nupkg	Transitive	N/A*	❌
CVE-2024-32655	High	8.1	npgsql.7.0.6.nupkg	Transitive	N/A*	❌
CVE-2024-38095	High	7.5	system.formats.asn1.8.0.0.nupkg	Transitive	N/A*	❌
CVE-2024-21319	Medium	6.8	system.identitymodel.tokens.jwt.7.0.3.nupkg	Transitive	N/A*	❌
CVE-2024-35255	Medium	5.5	microsoft.identity.client.4.57.0.nupkg	Transitive	N/A*	❌
CVE-2024-27086	Low	3.9	microsoft.identity.client.4.57.0.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-0056

Vulnerable Library - microsoft.data.sqlclient.5.1.2.nupkg

Provides the data provider for SQL Server.

Library home page: https://api.nuget.org/packages/microsoft.data.sqlclient.5.1.2.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.Workflows/OrchardCore.Workflows.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.data.sqlclient/5.1.2/microsoft.data.sqlclient.5.1.2.nupkg

Dependency Hierarchy:

• OrchardCore.ContentFields-1.8.0-preview (Root Library)
  • OrchardCore.ContentManagement.GraphQL-1.8.0-preview
    • OrchardCore.ContentManagement-1.8.0-preview
      • OrchardCore.Data.YesSql-1.8.0-preview
        • yessql.3.5.0.nupkg
          • yessql.provider.sqlserver.3.5.0.nupkg
            • ❌ microsoft.data.sqlclient.5.1.2.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-0056

CVSS 3 Score Details (8.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-98g6-xh36-x2p7

Release Date: 2024-01-09

Fix Resolution: Microsoft.Data.SqlClient - 2.1.7,3.1.5,4.0.5,5.1.3, System.Data.SqlClient - 4.8.6

CVE-2024-32655

Vulnerable Library - npgsql.7.0.6.nupkg

Npgsql is the open source .NET data provider for PostgreSQL.

Library home page: https://api.nuget.org/packages/npgsql.7.0.6.nupkg

Path to dependency file: /src/OrchardCore.Modules/OrchardCore.Workflows/OrchardCore.Workflows.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/npgsql/7.0.6/npgsql.7.0.6.nupkg

Dependency Hierarchy:

• OrchardCore.ContentFields-1.8.0-preview (Root Library)
  • OrchardCore.ContentManagement.GraphQL-1.8.0-preview
    • OrchardCore.ContentManagement-1.8.0-preview
      • OrchardCore.Data.YesSql-1.8.0-preview
        • yessql.3.5.0.nupkg
          • yessql.provider.postgresql.3.5.0.nupkg
            • ❌ npgsql.7.0.6.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Npgsql is the .NET data provider for PostgreSQL. The WriteBind() method in src/Npgsql/Internal/NpgsqlConnector.FrontendMessages.cs uses int variables to store the message length and the sum of parameter lengths. Both variables overflow when the sum of parameter lengths becomes too large. This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf. This vulnerability is fixed in 4.0.14, 4.1.13, 5.0.18, 6.0.11, 7.0.7, and 8.0.3.

Publish Date: 2024-05-09

URL: CVE-2024-32655

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-32655

Release Date: 2024-05-09

Fix Resolution: Npgsql - 4.0.14,4.1.13,5.0.18,6.0.11,7.0.7,8.0.3

CVE-2024-38095

Vulnerable Library - system.formats.asn1.8.0.0.nupkg

Provides classes that can read and write the ASN.1 BER, CER, and DER data formats.

Commonly Used Types:
System.Formats.Asn1.AsnReader
System.Formats.Asn1.AsnWriter

Library home page: https://api.nuget.org/packages/system.formats.asn1.8.0.0.nupkg

Path to dependency file: /src/OrchardCore/OrchardCore.Redis.Abstractions/OrchardCore.Redis.Abstractions.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.formats.asn1/8.0.0/system.formats.asn1.8.0.0.nupkg

Dependency Hierarchy:

• OrchardCore.ContentFields-1.8.0-preview (Root Library)
  • OrchardCore.ContentManagement.GraphQL-1.8.0-preview
    • OrchardCore.ContentManagement-1.8.0-preview
      • OrchardCore.Data.YesSql-1.8.0-preview
        • yessql.3.5.0.nupkg
          • yessql.provider.sqlserver.3.5.0.nupkg
            • microsoft.data.sqlclient.5.1.2.nupkg
              • system.security.cryptography.cng.5.0.0.nupkg
                • ❌ system.formats.asn1.8.0.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

.NET and Visual Studio Denial of Service Vulnerability

Publish Date: 2024-07-09

URL: CVE-2024-38095

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-447r-wph3-92pm

Release Date: 2024-07-09

Fix Resolution: Microsoft.NetCore.App.Runtime - 6.0.32,8.0.7, System.Formats.Asn1 - 6.0.1,8.0.1

CVE-2024-21319

Vulnerable Library - system.identitymodel.tokens.jwt.7.0.3.nupkg

Includes types that provide support for creating, serializing and validating JSON Web Tokens.

Library home page: https://api.nuget.org/packages/system.identitymodel.tokens.jwt.7.0.3.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.identitymodel.tokens.jwt/7.0.3/system.identitymodel.tokens.jwt.7.0.3.nupkg

Dependency Hierarchy:

• OrchardCore.ContentFields-1.8.0-preview (Root Library)
  • OrchardCore.ContentManagement.GraphQL-1.8.0-preview
    • OrchardCore.ContentManagement-1.8.0-preview
      • OrchardCore.Data.YesSql-1.8.0-preview
        • yessql.3.5.0.nupkg
          • yessql.provider.sqlserver.3.5.0.nupkg
            • microsoft.data.sqlclient.5.1.2.nupkg
              • microsoft.identitymodel.protocols.openidconnect.7.0.3.nupkg
                • ❌ system.identitymodel.tokens.jwt.7.0.3.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Microsoft Identity Denial of service vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-21319

CVSS 3 Score Details (6.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8g9c-28fc-mcx2

Release Date: 2024-01-09

Fix Resolution: System.IdentityModel.Tokens.Jwt - 5.7.0,6.34.0,7.1.2, Microsoft.IdentityModel.JsonWebTokens - 5.7.0,6.34.0,7.1.2

CVE-2024-35255

Vulnerable Library - microsoft.identity.client.4.57.0.nupkg

This package contains the binaries of the Microsoft Authentication Library for .NET (MSAL.NET).

Library home page: https://api.nuget.org/packages/microsoft.identity.client.4.57.0.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.identity.client/4.57.0/microsoft.identity.client.4.57.0.nupkg

Dependency Hierarchy:

• OrchardCore.ContentFields-1.8.0-preview (Root Library)
  • OrchardCore.ContentManagement.GraphQL-1.8.0-preview
    • OrchardCore.ContentManagement-1.8.0-preview
      • OrchardCore.Data.YesSql-1.8.0-preview
        • yessql.3.5.0.nupkg
          • yessql.provider.sqlserver.3.5.0.nupkg
            • microsoft.data.sqlclient.5.1.2.nupkg
              • ❌ microsoft.identity.client.4.57.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Publish Date: 2024-06-11

URL: CVE-2024-35255

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m5vv-6r4h-3vj9

Release Date: 2024-06-11

Fix Resolution: @azure/identity - 4.2.1, @azure/msal-node - 2.9.1, Azure.Identity - 1.11.4, Microsoft.Identity.Client - 4.61.3, azure-identity - 1.16.1, com.azure:azure-identity:1.12.2, github.com/Azure/azure-sdk-for-go/sdk/azidentity - 1.6.0

CVE-2024-27086

Vulnerable Library - microsoft.identity.client.4.57.0.nupkg

This package contains the binaries of the Microsoft Authentication Library for .NET (MSAL.NET).

Library home page: https://api.nuget.org/packages/microsoft.identity.client.4.57.0.nupkg

Path to dependency file: /src/OrchardCore.Cms.Web/OrchardCore.Cms.Web.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.identity.client/4.57.0/microsoft.identity.client.4.57.0.nupkg

Dependency Hierarchy:

• OrchardCore.ContentFields-1.8.0-preview (Root Library)
  • OrchardCore.ContentManagement.GraphQL-1.8.0-preview
    • OrchardCore.ContentManagement-1.8.0-preview
      • OrchardCore.Data.YesSql-1.8.0-preview
        • yessql.3.5.0.nupkg
          • yessql.provider.sqlserver.3.5.0.nupkg
            • microsoft.data.sqlclient.5.1.2.nupkg
              • ❌ microsoft.identity.client.4.57.0.nupkg (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability.
A malicious application running on a customer Android device can cause local denial of service against applications that were built using MSAL.NET for authentication on the same device (i.e., prevent the user of the legitimate application from logging in) due to incorrect activity export configuration. MSAL.NET version 4.60.1 includes the fix. As a workaround, a developer may explicitly mark the MSAL.NET activity non-exported.

Publish Date: 2024-04-16

URL: CVE-2024-27086

CVSS 3 Score Details (3.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-x674-v45j-fwxw

Release Date: 2024-04-16

Fix Resolution: Microsoft.Identity.Client - 4.59.1,4.60.3