silverstripe/graphql Cross-Site Request Forgery vulnerability · GHSA-wjg9-v8cf-f5q2 · GitHub Advisory Database · GitHub

silverstripe/graphql Cross-Site Request Forgery vulnerability

High severity GitHub Reviewed Published May 28, 2024 to the GitHub Advisory Database • Updated May 28, 2024

Package

silverstripe/graphql (Composer)

Affected versions

>= 2.0.0, < 2.0.3

Patched versions

2.0.3

Description

The GraphQL controller lacked any CSRF protection, meaning authenticated users could be forced or tricked into visiting a URL that would send a GET request to the affected web server that could mutate or destroy data without the user knowing.

References

Published to the GitHub Advisory Database May 28, 2024

Reviewed May 28, 2024

Last updated May 28, 2024

Severity

High

7.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H