Merge pull request #1232 from jasnow/redo-adv

Redid existing activeadmin gem; swapped duplicate for not duplicate

@flavorjones - Thanks for taking the time to reviewing and approving this PR.

Author: jasnow

gems/activeadmin/CVE-2023-51763.yml

@@ -1,21 +1,43 @@
 ---
 gem: activeadmin
+framework: rails
 cve: 2023-51763
-ghsa: rqxc-9p8h-xqgq
-url: https://github.com/advisories/GHSA-rqxc-9p8h-xqgq
+ghsa: xhvv-3jww-c487
+url: https://nvd.nist.gov/vuln/detail/CVE-2023-51763
 title: ActiveAdmin vulnerable to CSV injection
 date: 2023-12-24
 description: |
-  csv_builder.rb in ActiveAdmin (aka Active Admin)
-  before 3.2.0 allows CSV injection.
-cvss_v3: 8.4
+  In ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet
+  formulas could be uploaded as part of admin data that, when exported
+  to a CSV file and the imported to a spreadsheet program like libreoffice,
+  could lead to remote code execution and private data exfiltration.
+
+  The attacker would need privileges to upload data to the same
+  ActiveAdmin application as the victim, and would need the victim
+  to possibly ignore security warnings from their spreadsheet program.
+cvss_v3: 9.8
 patched_versions:
   - ">= 3.2.0"
 related:
+  ghsa:
+    - rqxc-9p8h-xqgq
   url:
     - https://nvd.nist.gov/vuln/detail/CVE-2023-51763
+    - https://rubygems.org/gems/activeadmin/versions/3.2.0
+    - https://github.com/activeadmin/activeadmin/blob/master/CHANGELOG.md#320-
     - https://github.com/activeadmin/activeadmin/releases/tag/v3.2.0
+    - https://github.com/activeadmin/activeadmin/pull/8167
+    - https://github.com/activeadmin/activeadmin/commit/7af735cf657c73734fca1900cd6a5adac4ee706e
     - https://github.com/activeadmin/activeadmin/pull/8161
     - https://github.com/activeadmin/activeadmin/commit/697be2b183491beadc8f0b7d8b5bfb44f2387909
+    - https://jzee-rx.medium.com/cve-2023-51763-csv-injection-in-activeadmin-a-security-research-breakdown-d5b0d3663aa4
     - https://github.com/activeadmin/activeadmin/security/advisories/GHSA-xhvv-3jww-c487
+    - https://github.com/advisories/GHSA-xhvv-3jww-c487
+notes: |
+  - date, cvss_v3, related/url's from nvd.nist.gov URL.
+  - description from GHSA URL.
+  - GHSA: cvss_v3 is 5.4 (not used above).
+  - Treating GHSA-rqxc-9p8h-xqgq as the duplicate as GHSA does.
     - https://github.com/advisories/GHSA-rqxc-9p8h-xqgq
+  - Note that the repo security advisory does not have a
+    patch release but GHSA does.