Описание
silverstripe/graphql Cross-Site Request Forgery vulnerability
The GraphQL controller lacked any CSRF protection, meaning authenticated users could be forced or tricked into visiting a URL that would send a GET request to the affected web server that could mutate or destroy data without the user knowing.
Пакеты
Наименование
silverstripe/graphql
composer
Затронутые версииВерсия исправления
>= 2.0.0, < 2.0.3
2.0.3
7.3 High
CVSS3
Дефекты
CWE-352
7.3 High
CVSS3
Дефекты
CWE-352