PT-2023-22027 · Vtex · Vtex Apps-Graphql

Published 2023-03-31 · Updated 2023-04-08 · CVE-2023-28877

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VTEX apps-graphql versions 2.x

Description The VTEX apps-graphql GraphQL API module does not properly restrict unauthorized access to private configuration data.

Recommendations For VTEX apps-graphql versions 2.x, consider upgrading to version 3.x to resolve the issue, as version 3.x is unaffected by this problem.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-28877

Affected Products

Vtex Apps-Graphql

References · 5

• https://osv.dev/vulnerability/CVE-2023-28877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28877 · Security Note
• https://t.me/cvenotify/47800 · Telegram Post
• https://t.me/cibsecurity/61252 · Telegram Post
• https://developers.vtex.com/updates/release-notes/deprecation-of-apps-graphql%402.x · Note