{
  "schema_version": "1.4.0",
  "id": "GHSA-cv5c-2qv5-w2m2",
  "modified": "2024-05-20T16:51:28Z",
  "published": "2024-05-20T16:51:28Z",
  "aliases": [],
  "summary": "Passbolt Api Remote code execution",
  "details": "Passbolt provides a way for system administrators to generate a PGP key for the server during installation. The wizard requests a username, an e-mail address and an optional comment. No escaping or verification is done by Passbolt, effectively allowing a user to inject bash code.\n\nThe impact is very high, but the probability is very low given that this vulnerability can only be exploited during Passbolt’s installation stage.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "passbolt/passbolt_api"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/passbolt/passbolt_api/commit/be84671676ebac43d49e326a14f1afe259777611"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-02-11-1.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/passbolt/passbolt_api"
    },
    {
      "type": "WEB",
      "url": "https://www.passbolt.com/incidents/20190211_multiple_vulnerabilities"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-20T16:51:28Z",
    "nvd_published_at": null
  }
}