Jvr2022

**Name of the Vulnerable Software and Affected Versions** Quarkus OpenAPI Generator versions prior to 2.11.1-lts Quarkus OpenAPI Generator versions prior to 2.16.0-lts Quarkus OpenAPI Generator versions prior to 2.17.0 **Description** The generated authentication filter matches OpenAPI path templates too broadly when determining whether to attach credentials. The runtime authentication layer compares the outgoing request path and method against protected OpenAPI operations, but treats `{param}` placeholders as `.*`, which incorrectly allows a single path parameter to consume a forward slash (`/`). Consequently, a security scheme configured for one operation may be applied to a different operation of the same method if the path partially resembles the protected template. This can lead to bearer tokens, API keys, or basic credentials being sent to unintended endpoints, potentially disclosing sensitive information to lower-trust routes on the same service. **Recommendations** Update to version 2.11.1-lts. Update to version 2.16.0-lts. Update to version 2.17.0.

**Name of the Vulnerable Software and Affected Versions** OpenLearn versions prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab **Description** When `safeMode` is enabled, unapproved forum posts are hidden from the public list. However, the direct post-read procedure still returns the full post to any user who possesses the post UUID. **Recommendations** Update to commit 844b2a40a69d0c4911580fe501923f0b391313ab.

**Name of the Vulnerable Software and Affected Versions** @xmldom/xmldom versions prior to 0.8.13 @xmldom/xmldom versions prior to 0.9.10 xmldom versions prior to 0.6.0 **Description** The software allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. This occurs during the DOM construction and serialization flow for comment nodes when the `createComment()` function is called; the supplied string is stored as-is and later concatenated with XML comment delimiters during serialization. Because XML comments are syntax-sensitive, an attacker can provide input containing a sequence that closes the comment, allowing them to terminate the comment early and inject arbitrary XML nodes into the serialized output. This can enable an attacker to alter the meaning and structure of generated XML documents, affecting workflows that store, forward, sign, or parse the resulting XML, such as configuration or policy documents. **Recommendations** For @xmldom/xmldom versions prior to 0.8.13 and 0.9.10, update to version 0.8.13 or 0.9.10 and explicitly pass the `{ requireWellFormed: true }` option to the `serializeToString()` function to enable protection. For xmldom versions prior to 0.6.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** @xmldom/xmldom versions prior to 0.8.13 @xmldom/xmldom versions prior to 0.9.10 xmldom versions 0.6.0 and earlier **Description** Seven recursive traversals in `lib/dom.js` operate without a depth limit. When processing a sufficiently deeply nested DOM tree, the JavaScript call stack is exhausted, resulting in a `RangeError: Maximum call stack size exceeded` and crashing the application. This can lead to a denial of service if a service accepts attacker-controlled XML and performs any of the affected operations. The affected functions and entry points include - `Node.prototype.normalize()` - `XMLSerializer.serializeToString()` - `Element.getElementsByTagName()`, `getElementsByTagNameNS()`, `getElementsByClassName()`, and `getElementById()` (via the ` visitNode` function) - `Node.cloneNode(true)` - `Document.importNode(node, true)` - `node.textContent` (getter) - `Node.isEqualNode(other)` **Recommendations** Update @xmldom/xmldom to version 0.8.13 or 0.9.10. Update xmldom to a version later than 0.6.0. As a temporary workaround, restrict the use of the affected functions or limit the nesting depth of XML documents before they are processed by the library.

**Name of the Vulnerable Software and Affected Versions** Vite+ versions prior to 0.1.17 **Description** The `downloadPackageManager()` function accepts an untrusted `version` string and uses it directly in filesystem paths. This allows a caller to use absolute paths or `../` segments to escape the `VP HOME/package manager/<pm>/` cache root, enabling the deletion, replacement, and population of directories outside the intended cache location. **Recommendations** Update to version 0.1.17.

Name of the Vulnerable Software and Affected Versions PolarLearn versions 0-PRERELEASE-15 and earlier Description The software creates a valid session for banned accounts before verifying the supplied password via the `/api/v1/auth/sign-in` API endpoint. This session is then accepted across authenticated API routes, allowing access to account data and authenticated actions as the banned user. The vulnerable parameter is the `password`. Recommendations Update to a version later than 0-PRERELEASE-15.

Name of the Vulnerable Software and Affected Versions PolarLearn versions prior to 0-PRERELEASE-15 Description PolarLearn is a learning program affected by a privilege-escalation issue. An inverted admin check in the `account-management` module allowed authenticated non-admin users to execute the `setCustomPassword(userId, password)` and `deleteUser(userId)` actions, while legitimate administrators were blocked. The issue stems from an incorrect conditional statement that reverses the intended access control logic. Recommendations Update to version 0-PRERELEASE-15 or later.

**Name of the Vulnerable Software and Affected Versions** node-tar versions prior to 7.5.10 **Description** The node-tar package contains a flaw where it can be tricked into creating a hardlink that points outside the extraction directory. This is achieved by using a drive-relative link target, such as 'C:../target.txt', which allows for file overwrite outside the current working directory during normal tar.x() extraction. The extraction logic fails to properly handle '..' segments before stripping absolute roots, leading to the creation of the malicious hardlink. This issue is reachable when extracting attacker-controlled tar archives. The impact of this issue is an arbitrary file overwrite primitive outside the intended extraction root, with the permissions of the process performing extraction. **Recommendations** Versions prior to 7.5.10 should be updated to version 7.5.10 or later.

**Name of the Vulnerable Software and Affected Versions** PolarLearn versions prior to 0-PRERELEASE-16 **Description** PolarLearn is a free and open-source learning program. The group chat WebSocket at `wss://polarlearn.nl/api/v1/ws` can be used without authentication. An unauthenticated client can subscribe to any group chat by providing a group UUID and send messages to any group. The server accepts and stores these messages in the group’s `chatContent`. **Recommendations** Update PolarLearn to version 0-PRERELEASE-16 or later.

**Name of the Vulnerable Software and Affected Versions** @isaacs/brace-expansion versions prior to 5.0.1 **Description** @isaacs/brace-expansion, a hybrid CJS/ESM TypeScript fork of brace-expansion, is subject to a denial of service (DoS) issue. This occurs due to unbounded brace range expansion when processing patterns with repeated numeric brace ranges. The library attempts to generate all possible combinations synchronously, leading to excessive CPU and memory consumption, potentially crashing the Node.js process. **Recommendations** Update @isaacs/brace-expansion to version 5.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** PolarLearn versions 0-PRERELEASE-15 and earlier **Description** The OAuth 2.0 implementation for GitHub and Google login providers is susceptible to Login Cross-Site Request Forgery (CSRF). The application does not implement and verify the state parameter during the authentication process. This allows an attacker to pre-authenticate a session and deceive a victim into logging into the attacker’s account. As a result, any data entered or academic progress made by the victim is stored on the attacker’s account, potentially leading to data loss for the victim and information disclosure to the attacker. **Recommendations** Versions prior to 0-PRERELEASE-15 should be updated.

**Name of the Vulnerable Software and Affected Versions** PolarLearn versions 0-PRERELEASE-15 and earlier **Description** A timing attack in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. The vulnerability occurs because the server performs Argon2 password hashing only if the user exists in the database. Requests for existing users take approximately 650ms, while requests for non-existent users take approximately 160ms. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. The vulnerable API endpoint is the login endpoint. The `email address` is the vulnerable parameter. **Recommendations** Apply a fix to ensure consistent response times for both valid and invalid email addresses during the sign-in process.

**Name of the Vulnerable Software and Affected Versions** PolarLearn versions prior to 0-PRERELEASE-15 **Description** PolarLearn is a free and open-source learning program. The `POST /api/v1/forum/vote` API route trusts the `direction` value within the JSON body without runtime validation. TypeScript types are not enforced during runtime, allowing an attacker to send arbitrary strings, such as `"x"`, as the `direction` parameter. The `VoteServer` component interprets any value other than `"up"` or `null` as a downvote, persisting the invalid value in `votes data`. This can be used to bypass intended business logic. **Recommendations** Update to version 0-PRERELEASE-15 or later.

**Name of the Vulnerable Software and Affected Versions** node-tar versions <= 7.5.2 **Description** The node-tar library fails to sanitize the `linkpath` of `Link` (hardlink) and `SymbolicLink` entries when `preservePaths` is false, which is the default secure behavior. This allows malicious archives to bypass extraction root restrictions, potentially leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. The vulnerability exists within the `src/unpack.ts` file, specifically in the `[HARDLINK]` and `[SYMLINK]` methods. A malicious archive can create a hardlink to a sensitive file on the host and potentially overwrite it, if file permissions allow. Additionally, the library allows the creation of symbolic links pointing to sensitive absolute system paths or traversing paths, even with secure extraction defaults. **Recommendations** Update to node-tar version 7.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** node-tar versions prior to 7.5.11 **Description** The node-tar software contains a flaw where it can be manipulated into creating a symbolic link that points outside the intended extraction directory. This is achieved by utilizing a drive-relative symlink target, such as `C:../../../target.txt`, during the tar extraction process using the `tar.x()` function. Successful exploitation allows for file overwrites outside of the current working directory. **Recommendations** Update to node-tar version 7.5.11 or later.