| Package | Affected versions | Patched versions |
|---|---|---|
| silverstripe/graphql | ≥ 2.0.0, < 2.0.3 | 2.0.3 |
The GraphQL controller lacked any CSRF protection, meaning authenticated users could be forced or tricked into visiting a URL that would send a GET request to the affected web server that could mutate or destroy data without the user knowing.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free