GHSA-wjg9-v8cf-f5q2
GHSA-wjg9-v8cf-f5q2 · silverstripe/graphql Cross-Site Request Forgery vulnerability
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The GraphQL controller lacked any CSRF protection, meaning authenticated users could be forced or tricked into visiting a URL that would send a GET request to the affected web server that could mutate or destroy data without the user knowing.
CVSS 7.3 · Alta · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
silverstripe/graphql Packagist
- Versiones
- 2.0.0
- 2.0.1
- 2.0.2
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 2.0.0, < 2.0.3
Actualiza a 2.0.3
Fuentes originales
- https://github.com/silverstripe/silverstripe-graphql/commit/b59ba397ff42d8934bd2d9c932514f898c327f64
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/SS-2018-007-1.yaml
- https://github.com/silverstripe/silverstripe-graphql
- https://www.silverstripe.org/download/security-releases/ss-2018-007
- https://osv.dev/vulnerability/GHSA-wjg9-v8cf-f5q2