PT-2023-22027 · Vtex · Vtex Apps-Graphql

Publicado 2023-03-31 · Atualizado 2023-04-08 · CVE-2023-28877

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VTEX apps-graphql versions 2.x

Description The VTEX apps-graphql GraphQL API module does not properly restrict unauthorized access to private configuration data.

Recommendations For VTEX apps-graphql versions 2.x, consider upgrading to version 3.x to resolve the issue, as version 3.x is unaffected by this problem.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2023-28877

Produtos afetados

Vtex Apps-Graphql

Referências · 5

• https://t.me/cvenotify/47800 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28877 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-28877 · Nota de Segurança
• https://t.me/cibsecurity/61252 · Publicação no Telegram
• https://developers.vtex.com/updates/release-notes/deprecation-of-apps-graphql%402.x · Nota