зеркало из https://github.com/golang/vulndb.git
237 строки
8.0 KiB
JSON
237 строки
8.0 KiB
JSON
|
{
|
||
|
|
"schema_version": "1.3.1",
|
||
|
|
"id": "GO-2024-2936",
|
||
|
|
"modified": "0001-01-01T00:00:00Z",
|
||
|
|
"published": "0001-01-01T00:00:00Z",
|
||
|
|
"aliases": [
|
||
|
|
"CVE-2024-38351",
|
||
|
|
"GHSA-m93w-4fxv-r35v"
|
||
|
|
],
|
||
|
|
"summary": "PocketBase performs password auth and OAuth2 unverified email linking in github.com/pocketbase/pocketbase",
|
||
|
|
"details": "PocketBase performs password auth and OAuth2 unverified email linking in github.com/pocketbase/pocketbase",
|
||
|
|
"affected": [
|
||
|
|
{
|
||
|
|
"package": {
|
||
|
|
"name": "github.com/pocketbase/pocketbase",
|
||
|
|
"ecosystem": "Go"
|
||
|
|
},
|
||
|
|
"ranges": [
|
||
|
|
{
|
||
|
|
"type": "SEMVER",
|
||
|
|
"events": [
|
||
|
|
{
|
||
|
|
"introduced": "0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"fixed": "0.22.14"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"ecosystem_specific": {
|
||
|
|
"imports": [
|
||
|
|
{
|
||
|
|
"path": "github.com/pocketbase/pocketbase/apis",
|
||
|
|
"symbols": [
|
||
|
|
"EnrichRecord",
|
||
|
|
"EnrichRecords",
|
||
|
|
"RecordAuthResponse",
|
||
|
|
"Serve",
|
||
|
|
"recordAuthApi.authWithOAuth2",
|
||
|
|
"recordAuthApi.authWithPassword"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"path": "github.com/pocketbase/pocketbase/models",
|
||
|
|
"symbols": [
|
||
|
|
"NewRecordFromNullStringMap",
|
||
|
|
"NewRecordsFromNullStringMaps",
|
||
|
|
"Record.CleanCopy",
|
||
|
|
"Record.ColumnValueMap",
|
||
|
|
"Record.Email",
|
||
|
|
"Record.EmailVisibility",
|
||
|
|
"Record.FindFileFieldByFile",
|
||
|
|
"Record.Get",
|
||
|
|
"Record.GetBool",
|
||
|
|
"Record.GetDateTime",
|
||
|
|
"Record.GetFloat",
|
||
|
|
"Record.GetInt",
|
||
|
|
"Record.GetString",
|
||
|
|
"Record.GetStringSlice",
|
||
|
|
"Record.GetTime",
|
||
|
|
"Record.LastResetSentAt",
|
||
|
|
"Record.LastVerificationSentAt",
|
||
|
|
"Record.Load",
|
||
|
|
"Record.MarshalJSON",
|
||
|
|
"Record.OriginalCopy",
|
||
|
|
"Record.PasswordHash",
|
||
|
|
"Record.PublicExport",
|
||
|
|
"Record.RefreshTokenKey",
|
||
|
|
"Record.ReplaceModifers",
|
||
|
|
"Record.Set",
|
||
|
|
"Record.SetEmail",
|
||
|
|
"Record.SetEmailVisibility",
|
||
|
|
"Record.SetLastResetSentAt",
|
||
|
|
"Record.SetLastVerificationSentAt",
|
||
|
|
"Record.SetPassword",
|
||
|
|
"Record.SetTokenKey",
|
||
|
|
"Record.SetUsername",
|
||
|
|
"Record.SetVerified",
|
||
|
|
"Record.TokenKey",
|
||
|
|
"Record.UnknownData",
|
||
|
|
"Record.UnmarshalJSON",
|
||
|
|
"Record.UnmarshalJSONField",
|
||
|
|
"Record.Username",
|
||
|
|
"Record.ValidatePassword",
|
||
|
|
"Record.Verified",
|
||
|
|
"Record.getNormalizeDataValueForDB"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"path": "github.com/pocketbase/pocketbase/models/schema",
|
||
|
|
"symbols": [
|
||
|
|
"AuthFieldNames"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"path": "github.com/pocketbase/pocketbase/daos",
|
||
|
|
"symbols": [
|
||
|
|
"Dao.CanAccessRecord",
|
||
|
|
"Dao.CreateViewSchema",
|
||
|
|
"Dao.Delete",
|
||
|
|
"Dao.DeleteAdmin",
|
||
|
|
"Dao.DeleteCollection",
|
||
|
|
"Dao.DeleteExternalAuth",
|
||
|
|
"Dao.DeleteOldLogs",
|
||
|
|
"Dao.DeleteParam",
|
||
|
|
"Dao.DeleteRecord",
|
||
|
|
"Dao.DeleteTable",
|
||
|
|
"Dao.DeleteView",
|
||
|
|
"Dao.ExpandRecord",
|
||
|
|
"Dao.ExpandRecords",
|
||
|
|
"Dao.FindAdminByEmail",
|
||
|
|
"Dao.FindAdminById",
|
||
|
|
"Dao.FindAdminByToken",
|
||
|
|
"Dao.FindAllExternalAuthsByRecord",
|
||
|
|
"Dao.FindAuthRecordByEmail",
|
||
|
|
"Dao.FindAuthRecordByToken",
|
||
|
|
"Dao.FindAuthRecordByUsername",
|
||
|
|
"Dao.FindById",
|
||
|
|
"Dao.FindCollectionByNameOrId",
|
||
|
|
"Dao.FindCollectionReferences",
|
||
|
|
"Dao.FindCollectionsByType",
|
||
|
|
"Dao.FindExternalAuthByRecordAndProvider",
|
||
|
|
"Dao.FindFirstExternalAuthByExpr",
|
||
|
|
"Dao.FindFirstRecordByData",
|
||
|
|
"Dao.FindFirstRecordByFilter",
|
||
|
|
"Dao.FindLogById",
|
||
|
|
"Dao.FindParamByKey",
|
||
|
|
"Dao.FindRecordById",
|
||
|
|
"Dao.FindRecordByViewFile",
|
||
|
|
"Dao.FindRecordsByExpr",
|
||
|
|
"Dao.FindRecordsByFilter",
|
||
|
|
"Dao.FindRecordsByIds",
|
||
|
|
"Dao.FindSettings",
|
||
|
|
"Dao.HasTable",
|
||
|
|
"Dao.ImportCollections",
|
||
|
|
"Dao.IsAdminEmailUnique",
|
||
|
|
"Dao.IsCollectionNameUnique",
|
||
|
|
"Dao.IsRecordValueUnique",
|
||
|
|
"Dao.LogsStats",
|
||
|
|
"Dao.RecordQuery",
|
||
|
|
"Dao.RunInTransaction",
|
||
|
|
"Dao.Save",
|
||
|
|
"Dao.SaveAdmin",
|
||
|
|
"Dao.SaveCollection",
|
||
|
|
"Dao.SaveExternalAuth",
|
||
|
|
"Dao.SaveLog",
|
||
|
|
"Dao.SaveParam",
|
||
|
|
"Dao.SaveRecord",
|
||
|
|
"Dao.SaveSettings",
|
||
|
|
"Dao.SaveView",
|
||
|
|
"Dao.SuggestUniqueAuthRecordUsername",
|
||
|
|
"Dao.SyncRecordTableSchema",
|
||
|
|
"Dao.TableColumns",
|
||
|
|
"Dao.TableIndexes",
|
||
|
|
"Dao.TableInfo",
|
||
|
|
"Dao.TotalAdmins",
|
||
|
|
"Dao.Vacuum"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"path": "github.com/pocketbase/pocketbase/forms",
|
||
|
|
"symbols": [
|
||
|
|
"AdminLogin.Submit",
|
||
|
|
"AdminLogin.Validate",
|
||
|
|
"AdminPasswordResetConfirm.Submit",
|
||
|
|
"AdminPasswordResetConfirm.Validate",
|
||
|
|
"AdminPasswordResetRequest.Submit",
|
||
|
|
"AdminPasswordResetRequest.Validate",
|
||
|
|
"AdminUpsert.Submit",
|
||
|
|
"AdminUpsert.Validate",
|
||
|
|
"AppleClientSecretCreate.Submit",
|
||
|
|
"AppleClientSecretCreate.Validate",
|
||
|
|
"BackupCreate.Submit",
|
||
|
|
"BackupCreate.Validate",
|
||
|
|
"BackupUpload.Submit",
|
||
|
|
"BackupUpload.Validate",
|
||
|
|
"CollectionUpsert.Submit",
|
||
|
|
"CollectionUpsert.Validate",
|
||
|
|
"CollectionsImport.Submit",
|
||
|
|
"CollectionsImport.Validate",
|
||
|
|
"NewRecordUpsert",
|
||
|
|
"RealtimeSubscribe.Validate",
|
||
|
|
"RecordEmailChangeConfirm.Submit",
|
||
|
|
"RecordEmailChangeConfirm.Validate",
|
||
|
|
"RecordEmailChangeRequest.Submit",
|
||
|
|
"RecordEmailChangeRequest.Validate",
|
||
|
|
"RecordOAuth2Login.Submit",
|
||
|
|
"RecordOAuth2Login.Validate",
|
||
|
|
"RecordOAuth2Login.submit",
|
||
|
|
"RecordPasswordLogin.Submit",
|
||
|
|
"RecordPasswordLogin.Validate",
|
||
|
|
"RecordPasswordResetConfirm.Submit",
|
||
|
|
"RecordPasswordResetConfirm.Validate",
|
||
|
|
"RecordPasswordResetRequest.Submit",
|
||
|
|
"RecordPasswordResetRequest.Validate",
|
||
|
|
"RecordUpsert.DrySubmit",
|
||
|
|
"RecordUpsert.LoadData",
|
||
|
|
"RecordUpsert.LoadRequest",
|
||
|
|
"RecordUpsert.Submit",
|
||
|
|
"RecordUpsert.Validate",
|
||
|
|
"RecordUpsert.ValidateAndFill",
|
||
|
|
"RecordVerificationConfirm.Submit",
|
||
|
|
"RecordVerificationConfirm.Validate",
|
||
|
|
"RecordVerificationRequest.Submit",
|
||
|
|
"RecordVerificationRequest.Validate",
|
||
|
|
"SettingsUpsert.Submit",
|
||
|
|
"SettingsUpsert.Validate",
|
||
|
|
"TestEmailSend.Submit",
|
||
|
|
"TestEmailSend.Validate",
|
||
|
|
"TestS3Filesystem.Submit",
|
||
|
|
"TestS3Filesystem.Validate"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"references": [
|
||
|
|
{
|
||
|
|
"type": "ADVISORY",
|
||
|
|
"url": "https://github.com/pocketbase/pocketbase/security/advisories/GHSA-m93w-4fxv-r35v"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "FIX",
|
||
|
|
"url": "https://github.com/pocketbase/pocketbase/commit/58ace5d5e7b9b979490019cf8d1b88491e5daec5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "WEB",
|
||
|
|
"url": "https://github.com/pocketbase/pocketbase/discussions/4355"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"database_specific": {
|
||
|
|
"url": "https://pkg.go.dev/vuln/GO-2024-2936",
|
||
|
|
"review_status": "REVIEWED"
|
||
|
|
}
|
||
|
|
}
|