exploitDog

CVE-2019-12437

Опубликовано: 19 фев. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,

Ссылки

https://forum.silverstripe.org/c/releases
Release Notes
Vendor Advisory
https://www.silverstripe.org/blog/tag/release
Release Notes
Vendor Advisory
https://www.silverstripe.org/download/security-releases/
Vendor Advisory
https://forum.silverstripe.org/c/releases
Release Notes
Vendor Advisory
https://www.silverstripe.org/blog/tag/release
Release Notes
Vendor Advisory
https://www.silverstripe.org/download/security-releases/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*

Версия до 4.3.3 (включая)

EPSS

Процентиль: 42%

0.002

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-fx37-56v6-85q6

CVSS3: 8.8

github

больше 3 лет назад

Silverstripe CSRF Protection Bypass via GraphQL

EPSS

Процентиль: 42%

0.002

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352