Merge pull request #706 from jorgsowa/CVE-2023-49282

Add CVE-2023-49282 and CVE-2023-49283 for microsoft/microsoft-graph
FriendsOfPHP · Feb 7, 2024 · 0dd8b16 · 0dd8b16
2 parents b4d49b1 + 7c73b85
commit 0dd8b16
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/microsoft/microsoft-graph-core/CVE-2023-49283.yaml b/microsoft/microsoft-graph-core/CVE-2023-49283.yaml
@@ -0,0 +1,8 @@
+title: 'Test code in published microsoft-graph-core package exposes phpinfo()'
+link: 'https://nvd.nist.gov/vuln/detail/CVE-2023-49283'
+cve: CVE-2023-49283
+branches:
+    2.x:
+        time: 2023-11-30 12:40:00
+        versions: ['<2.0.2']
+reference: 'composer://microsoft/microsoft-graph-core'
diff --git a/microsoft/microsoft-graph/CVE-2023-49282.yaml b/microsoft/microsoft-graph/CVE-2023-49282.yaml
@@ -0,0 +1,11 @@
+title: 'Test code in published microsoft-graph package exposes phpinfo()'
+link: 'https://nvd.nist.gov/vuln/detail/CVE-2023-49282'
+cve: CVE-2023-49282
+branches:
+    1.x:
+        time: 2023-11-30 12:40:00
+        versions: ['>=1.16.0', '<1.109.1']
+    2.x:
+        time: 2023-11-30 12:40:00
+        versions: ['>=2.0.0', '<2.0.1']
+reference: 'composer://microsoft/microsoft-graph'