Skip to content

Commit 20a9e97

Browse files
jdaigneau5jdaigneau5
authored
Merge pull request #230 from CVEProject/srl-208
Adds cnaContainer examples for v5.0
2 parents f8f54d5 + c844df1 commit 20a9e97

6 files changed

+341
-4
lines changed

‎.github/workflows/validate-schema.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -32,5 +32,5 @@ jobs:
3232
- name: Validate JSON schema
3333
run: |
3434
ajv compile -c ajv-formats -s "${CVE_SCHEMA_DIR}/docs/CVE_JSON_5.0_bundled.json"
35-
ajv validate -c ajv-formats -s "${CVE_SCHEMA_DIR}/docs/CVE_JSON_5.0_bundled.json" -d "${CVE_SCHEMA_DIR}/docs/basic-example.json"
36-
ajv validate -c ajv-formats -s "${CVE_SCHEMA_DIR}/docs/CVE_JSON_5.0_bundled.json" -d "${CVE_SCHEMA_DIR}/docs/advanced-example.json"
35+
ajv validate -c ajv-formats -s "${CVE_SCHEMA_DIR}/docs/CVE_JSON_5.0_bundled.json" -d "${CVE_SCHEMA_DIR}/docs/full-record-basic-example.json"
36+
ajv validate -c ajv-formats -s "${CVE_SCHEMA_DIR}/docs/CVE_JSON_5.0_bundled.json" -d "${CVE_SCHEMA_DIR}/docs/full-record-advanced-example.json"

‎README.md

+6-2
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,12 @@ Documentation about this format is available at https://cveproject.github.io/cve
1414

1515
A mindmap version of the CVE record structure is at https://cveproject.github.io/cve-schema/schema/v5.0/docs/mindmap.html
1616

17-
A basic example record in 5.0 format with minimally required fields is available at https://github.com/cveproject/cve-schema/blob/master/schema/v5.0/docs/basic-example.json
17+
A basic example of a full record in 5.0 format with minimally required fields is available at https://github.com/cveproject/cve-schema/blob/master/schema/v5.0/docs/full-record-basic-example.json
1818

19-
An advanced example record in 5.0 format is available at https://github.com/cveproject/cve-schema/blob/master/schema/v5.0/docs/advanced-example.json
19+
An advanced example of a full record in 5.0 format is available at https://github.com/cveproject/cve-schema/blob/master/schema/v5.0/docs/full-record-advanced-example.json
20+
21+
A basic example of a cnaContainer, to be used with CVE Services, is available at https://github.com/cveproject/cve-schema/blob/master/schema/v5.0/docs/cnaContainer-basic-example.json
22+
23+
An advanced example of a cnaContainer, to be used with CVE Services, is available at https://github.com/cveproject/cve-schema/blob/master/schema/v5.0/docs/cnaContainer-advanced-example.json
2024

2125
More details about Product and Version Encodings in CVE JSON 5.0 record is at https://github.com/CVEProject/cve-schema/blob/master/schema/v5.0/docs/versions.md

‎schema/v5.0/docs/cnaContainer-advanced-example.json

+293
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,293 @@
1+
{
2+
"cnaContainer": {
3+
"title": "Buffer overflow in Example Enterprise allows Privilege Escalation.",
4+
"datePublic": "2021-09-08T16:24:00.000Z",
5+
"problemTypes": [
6+
{
7+
"descriptions": [
8+
{
9+
"lang": "en",
10+
"cweId": "CWE-78",
11+
"description": "CWE-78 OS Command Injection",
12+
"type": "CWE"
13+
}
14+
]
15+
}
16+
],
17+
"impacts": [
18+
{
19+
"capecId": "CAPEC-233",
20+
"descriptions": [
21+
{
22+
"lang": "en",
23+
"value": "CAPEC-233 Privilege Escalation"
24+
}
25+
]
26+
}
27+
],
28+
"affected": [
29+
{
30+
"vendor": "Example.org",
31+
"product": "Example Enterprise",
32+
"platforms": [
33+
"Windows",
34+
"MacOS",
35+
"XT-4500"
36+
],
37+
"collectionURL": "https://example.org/packages",
38+
"packageName": "example_enterprise",
39+
"repo": "git://example.org/source/example_enterprise",
40+
"modules": [
41+
"Web-Management-Interface"
42+
],
43+
"programFiles": [
44+
"http://example_enterprise/example.php"
45+
],
46+
"programRoutines": [
47+
{
48+
"name": "parseFilename"
49+
}
50+
],
51+
"versions": [
52+
{
53+
"version": "1.0.0",
54+
"status": "affected",
55+
"lessThan": "1.0.6",
56+
"versionType": "semver"
57+
},
58+
{
59+
"version": "2.1.0",
60+
"status": "unaffected",
61+
"lessThan": "2.1.*",
62+
"changes": [
63+
{
64+
"at": "2.1.6",
65+
"status": "affected"
66+
},
67+
{
68+
"at": "2.1.9",
69+
"status": "unaffected"
70+
}
71+
],
72+
"versionType": "semver"
73+
},
74+
{
75+
"version": "3.0.0",
76+
"status": "unaffected",
77+
"lessThan": "*",
78+
"versionType": "semver"
79+
}
80+
],
81+
"defaultStatus": "unaffected"
82+
}
83+
],
84+
"descriptions": [
85+
{
86+
"lang": "en",
87+
"value": "OS Command Injection vulnerability parseFilename function of example.php in the Web Management Interface of Example.org Example Enterprise on Windows, macOS, and XT-4500 allows remote unauthenticated attackers to escalate privileges. This issue affects: 1.0 versions before 1.0.6, 2.1 versions from 2.16 until 2.1.9.",
88+
"supportingMedia": [
89+
{
90+
"type": "text/html",
91+
"base64": false,
92+
"value": "OS Command Injection vulnerability <tt>parseFilename</tt> function of <tt>example.php</tt> in the Web Management Interface of Example.org Example Enterprise on Windows, macOS, and XT-4500 allows remote unauthenticated attackers to escalate privileges.<br><br>This issue affects:<br><ul><li>1.0 versions before 1.0.6</li><li>2.1 versions from 2.16 until 2.1.9.</li></ul>"
93+
}
94+
]
95+
},
96+
{
97+
"lang": "eo",
98+
"value": "OS-komand-injekta vundebleco parseFilename funkcio de example.php en la Web Administrado-Interfaco de Example.org Example Enterprise ĉe Windows, macOS kaj XT-4500 permesas al malproksimaj neaŭtentikigitaj atakantoj eskaladi privilegiojn. Ĉi tiu afero efikas: 1.0-versioj antaŭ 1.0.6, 2.1-versioj de 2.16 ĝis 2.1.9.",
99+
"supportingMedia": [
100+
{
101+
"type": "text/html",
102+
"base64": false,
103+
"value": "OS-komand-injekta vundebleco <tt>parseFilename</tt> funkcio de <tt>example.php</tt> en la Web Administrado-Interfaco de Example.org Example Enterprise ĉe Windows, macOS kaj XT-4500 permesas al malproksimaj neaŭtentikigitaj atakantoj eskaladi privilegiojn.<br><br> Ĉi tiu afero efikas:<br><ul><li>1.0-versioj antaŭ 1.0.6</li><li>2.1-versioj de 2.16 ĝis 2.1.9.</li></ul>"
104+
}
105+
]
106+
}
107+
],
108+
"metrics": [
109+
{
110+
"format": "CVSS",
111+
"scenarios": [
112+
{
113+
"lang": "en",
114+
"value": "GENERAL"
115+
}
116+
],
117+
"cvssV3_1": {
118+
"version": "3.1",
119+
"attackVector": "NETWORK",
120+
"attackComplexity": "LOW",
121+
"privilegesRequired": "NONE",
122+
"userInteraction": "NONE",
123+
"scope": "UNCHANGED",
124+
"confidentialityImpact": "HIGH",
125+
"integrityImpact": "HIGH",
126+
"availabilityImpact": "HIGH",
127+
"baseScore": 9.8,
128+
"baseSeverity": "CRITICAL",
129+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
130+
}
131+
},
132+
{
133+
"format": "CVSS",
134+
"scenarios": [
135+
{
136+
"lang": "en",
137+
"value": "If the enhanced host protection mode is turned on, this vulnerability can only be exploited to run os commands as user 'nobody'. Privilege escalation is not possible."
138+
}
139+
],
140+
"cvssV3_1": {
141+
"version": "3.1",
142+
"attackVector": "NETWORK",
143+
"attackComplexity": "LOW",
144+
"privilegesRequired": "NONE",
145+
"userInteraction": "NONE",
146+
"scope": "UNCHANGED",
147+
"confidentialityImpact": "LOW",
148+
"integrityImpact": "LOW",
149+
"availabilityImpact": "LOW",
150+
"baseScore": 7.3,
151+
"baseSeverity": "HIGH",
152+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
153+
}
154+
}
155+
],
156+
"solutions": [
157+
{
158+
"lang": "en",
159+
"value": "This issue is fixed in 1.0.6, 2.1.9, and 3.0.0 and all later versions.",
160+
"supportingMedia": [
161+
{
162+
"type": "text/html",
163+
"base64": false,
164+
"value": "This issue is fixed in 1.0.6, 2.1.9, and 3.0.0 and all later versions."
165+
}
166+
]
167+
}
168+
],
169+
"workarounds": [
170+
{
171+
"lang": "en",
172+
"value": "Disable the web management interface with the command\n> service disable webmgmt",
173+
"supportingMedia": [
174+
{
175+
"type": "text/html",
176+
"base64": false,
177+
"value": "Disable the web management interface with the command<br><pre>&gt; <b>service disable webmgmt</b></pre>"
178+
}
179+
]
180+
}
181+
],
182+
"configurations": [
183+
{
184+
"lang": "en",
185+
"value": "Web management interface should be enabled.\n> service status webmgmt\nwebmgmt running",
186+
"supportingMedia": [
187+
{
188+
"type": "text/html",
189+
"base64": false,
190+
"value": "Web management interface should be enabled.<br><pre>&gt; <b>service status webmgmt</b><br>webmgmt running</pre>"
191+
}
192+
]
193+
}
194+
],
195+
"exploits": [
196+
{
197+
"lang": "en",
198+
"value": "Example.org is not aware of any malicious exploitation of the issue however exploits targeting this issue are publicly available.",
199+
"supportingMedia": [
200+
{
201+
"type": "text/html",
202+
"base64": false,
203+
"value": "Example.org is not aware of any malicious exploitation of the issue however exploits targeting this issue are publicly available."
204+
}
205+
]
206+
}
207+
],
208+
"timeline": [
209+
{
210+
"time": "2001-09-01T07:31:00.000Z",
211+
"lang": "en",
212+
"value": "Issue discovered by Alice using Acme Autofuzz"
213+
},
214+
{
215+
"time": "2021-09-02T16:36:00.000Z",
216+
"lang": "en",
217+
"value": "Confirmed by Bob"
218+
},
219+
{
220+
"time": "2021-09-07T16:37:00.000Z",
221+
"lang": "en",
222+
"value": "Fixes released"
223+
}
224+
],
225+
"credits": [
226+
{
227+
"lang": "en",
228+
"value": "Alice",
229+
"type": "finder"
230+
},
231+
{
232+
"lang": "en",
233+
"value": "Bob",
234+
"type": "analyst"
235+
},
236+
{
237+
"lang": "en",
238+
"value": "Acme Autofuzz",
239+
"type": "tool"
240+
}
241+
],
242+
"references": [
243+
{
244+
"url": "https://example.org/ESA-22-11-CVE-1337-1234",
245+
"name": "ESA-22-11",
246+
"tags": [
247+
"vendor-advisory"
248+
]
249+
},
250+
{
251+
"url": "https://example.com/blog/alice/pwning_example_enterprise",
252+
"name": "Pwning Example Enterprise",
253+
"tags": [
254+
"technical-description",
255+
"third-party-advisory"
256+
]
257+
},
258+
{
259+
"url": "https://example.org/bugs/EXAMPLE-1234",
260+
"name": "EXAMPLE-1234",
261+
"tags": [
262+
"issue-tracking"
263+
]
264+
},
265+
{
266+
"url": "https://example.org/ExampleEnterprise",
267+
"tags": [
268+
"product"
269+
]
270+
}
271+
],
272+
"source": {
273+
"defects": [
274+
"EXAMPLE-1234"
275+
],
276+
"advisory": "ESA-22-11",
277+
"discovery": "EXTERNAL"
278+
},
279+
"taxonomyMappings": [
280+
{
281+
"taxonomyName": "ATT&CK",
282+
"taxonomyVersion": "v9",
283+
"taxonomyRelations": [
284+
{
285+
"taxonomyId": "T1190",
286+
"relationshipName": "mitigated by",
287+
"relationshipValue": "M1048"
288+
}
289+
]
290+
}
291+
]
292+
}
293+
}

‎schema/v5.0/docs/cnaContainer-basic-example.json

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"cnaContainer": {
3+
"problemTypes": [
4+
{
5+
"descriptions": [
6+
{
7+
"lang": "en",
8+
"description": "CWE-78 OS Command Injection"
9+
}
10+
]
11+
}
12+
],
13+
"affected": [
14+
{
15+
"vendor": "Example.org",
16+
"product": "Example Enterprise",
17+
"versions": [
18+
{
19+
"version": "1.0.0",
20+
"status": "affected",
21+
"lessThan": "1.0.6",
22+
"versionType": "semver"
23+
}
24+
],
25+
"defaultStatus": "unaffected"
26+
}
27+
],
28+
"descriptions": [
29+
{
30+
"lang": "en",
31+
"value": "OS Command Injection vulnerability parseFilename function of example.php in the Web Management Interface of Example.org Example Enterprise on Windows, MacOS and XT-4500 allows remote unauthenticated attackers to escalate privileges.\n\nThis issue affects:\n * 1.0 versions before 1.0.6\n * 2.1 versions from 2.16 until 2.1.9."
32+
}
33+
],
34+
"references": [
35+
{
36+
"url": "https://example.org/ESA-22-11-CVE-1337-1234"
37+
}
38+
]
39+
}
40+
}

‎schema/v5.0/docs/advanced-example.json renamed to ‎schema/v5.0/docs/full-record-advanced-example.json

File renamed without changes.

‎schema/v5.0/docs/basic-example.json renamed to ‎schema/v5.0/docs/full-record-basic-example.json

File renamed without changes.

0 commit comments

Comments
 (0)