CVE-2023-22477

Опубликовано: 09 янв. 2023

Источник: nvd

CVSS3: 5.3

CVSS3: 7.5

EPSS Низкий

Описание

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in #940. As a workaround, users can disable subscriptions.

Ссылки

https://github.com/mercurius-js/mercurius/issues/939
Exploit
Issue Tracking
Third Party Advisory
https://github.com/mercurius-js/mercurius/pull/940
Patch
Third Party Advisory
https://github.com/mercurius-js/mercurius/security/advisories/GHSA-cm8h-q92v-xcfc
Patch
Third Party Advisory
https://github.com/mercurius-js/mercurius/issues/939
Exploit
Issue Tracking
Third Party Advisory
https://github.com/mercurius-js/mercurius/pull/940
Patch
Third Party Advisory
https://github.com/mercurius-js/mercurius/security/advisories/GHSA-cm8h-q92v-xcfc
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mercurius_project:mercurius:*:*:*:*:*:node.js:*:*

Версия до 8.13.2 (исключая)

cpe:2.3:a:mercurius_project:mercurius:*:*:*:*:*:node.js:*:*

Версия от 9.0.0 (включая) до 11.5.0 (исключая)

EPSS

Процентиль: 48%

0.00247

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-248

NVD-CWE-Other

Связанные уязвимости

GHSA-cm8h-q92v-xcfc

CVSS3: 5.3

github

около 3 лет назад

mercurius has Uncaught Exception when using subscriptions

EPSS

Процентиль: 48%

0.00247

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

Дефекты

CWE-248

NVD-CWE-Other