PT-2020-9321 · Silverstripe · Silverstripe/Graphql+1

Published 2020-02-19 · Updated 2022-05-24 · CVE-2019-12437

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SilverStripe versions prior to 4.3.4 SilverStripe/GraphQL versions prior to 2.0.5 SilverStripe/GraphQL versions prior to 3.1.2

Description: The previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations.

Recommendations: For SilverStripe versions prior to 4.3.4, update to version 4.3.4 or later. For SilverStripe/GraphQL versions prior to 2.0.5, update to version 2.0.5 or later. For SilverStripe/GraphQL versions prior to 3.1.2, update to version 3.1.2 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-12437

GHSA-FX37-56V6-85Q6

Affected Products

Silverstripe

Silverstripe/Graphql

References · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2019-12437.yaml · Exploit
• https://silverstripe.org/blog/tag/release · Vendor Advisory
• https://silverstripe.org/download/security-releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12437 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12437 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fx37-56v6-85q6 · Vendor Advisory
• https://forum.silverstripe.org/c/releases · Vendor Advisory
• https://github.com/silverstripe/silverstripe-graphql · Note
• https://github.com/silverstripe/silverstripe-graphql/commit/3c1dd6b839b7c0e2cbc85074bb5840ebded6097c · Note
• https://github.com/silverstripe/silverstripe-graphql/commit/db28f3075ae2335905f43ac808e9177497e354ff · Note
• https://t.me/cvenotify/1086 · Telegram Post
• https://silverstripe.org/download/security-releases/cve-2019-12437 · Note