Описание
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
Ссылки
- Issue TrackingThird Party Advisory
- Issue TrackingThird Party Advisory
- Issue TrackingThird Party Advisory
- Issue TrackingThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 2.2.0 (включая) до 2.3.5 (включая)
cpe:2.3:a:api-platform:core:*:*:*:*:*:*:*:*
EPSS
Процентиль: 37%
0.00161
Низкий
6.5 Medium
CVSS3
5.5 Medium
CVSS2
Дефекты
NVD-CWE-noinfo
Связанные уязвимости
CVSS3: 6.5
github
больше 6 лет назад
Incorrect Access Control vulnerability in api-platform/core
EPSS
Процентиль: 37%
0.00161
Низкий
6.5 Medium
CVSS3
5.5 Medium
CVSS2
Дефекты
NVD-CWE-noinfo