[GHSA-gp8f-8m3g-qvj9] Next.js Cache Poisoning

[cold-try]

Updates

• Affected products
• CVSS v3

Comments
Hi,

I'm Allam Rachid (zhero;), one of the two people credited in the body of this security advisory, and I'm making this "suggest an improvement" request so that you also add -if possible- my github account as a finder.

Thank you in advance,
Regards!

[github]

Hi there @ijjk! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[ijjk]

Why is the CVSS changed? If you would like to add your GitHub in the above credits line I think that should be alright but I think this part should stay the same.

[cold-try]

Hi @ijjk, yes the CVSS should remain the same. I haven't touched anything in the advisory, but when submitting the form, the CVSS part seems to be removed.
I closed my first pull request for this reason, thinking I had made a mistake.

Thanks!

[JonathanLEvans]

Because it caused confusion for users, we no longer a CVSS v4 vectors to advisories that already have a v3 vector. Unfortunately, there is currently an issue where the contribution form will remove the CVSS_V3 vector if there is a CVSS_V4 vector. However, every contribution is reviewed by an analyst before approval and we make the appropriate ourselves.

[JonathanLEvans]

Hi @cold-try, GitHub does not add users as finders. However, since the advisory originated from a repo GHSA, you can ask the maintainer of the repo to add you to the advisory as a finder. If they do, you will also show up as a finder in the global GHSA.