Add CVSS 3.1 severity for GHSA-92wp-jghr-hh87

[sunnypatell]

Changes

Added CVSS 3.1 scoring to GHSA-92wp-jghr-hh87 (Ninja Core weak encryption implementation).

• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High)

CVSS justification

• AV:N - encrypted data transmitted over the network can be intercepted and decrypted
• AC:L - weak cryptographic implementation makes decryption straightforward without needing special conditions
• PR:N/UI:N - no authentication or user interaction required to capture and exploit the weak encryption
• C:H - sensitive data protected by the weak encryption (e.g., session tokens, credentials) can be fully recovered

References

• NVD: CVE-2024-36823
• Issue

[Copilot]

Pull request overview

This pull request adds CVSS 3.1 severity scoring to security advisory GHSA-92wp-jghr-hh87, which documents a weak encryption vulnerability in Ninja Core v7.0.0. The change populates the previously empty severity array with a CVSS v3.1 vector string that evaluates to a base score of 7.5 (High severity).

Changes:

• Added CVSS 3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N to the severity field

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.