PT-2024-40501 · Packagist · Silverstripe/Graphql

Published 2024-05-28 · Updated 2024-05-28

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned

Description The issue concerns a lack of CSRF protection in the GraphQL controller. This means that authenticated users could be forced or tricked into visiting a URL that sends a GET request to the affected web server, potentially mutating or destroying data without the user's knowledge.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

GHSA-WJG9-V8CF-F5Q2

Affected Products

Silverstripe/Graphql

References · 5

• https://osv.dev/vulnerability/GHSA-wjg9-v8cf-f5q2 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/SS-2018-007-1.yaml · Note
• https://github.com/silverstripe/silverstripe-graphql/commit/b59ba397ff42d8934bd2d9c932514f898c327f64 · Note
• https://github.com/silverstripe/silverstripe-graphql · Note
• https://silverstripe.org/download/security-releases/ss-2018-007 · Note