Craft CMS SQL injection vulnerability via the GraphQL API endpoint

CRÍTICO 9.8CVE-2024-37843 · GHSA-hq4f-mv3q-8wcv · Published 25/06/2024 · updated 17/06/2026

En resumen

CVE-2024-37843 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a craftcms/cms, craft cms (craftcms).
Probabilidad de explotación en los próximos 30 días (EPSS): 53.2%, mayor que el 99.0% de las vulnerabilidades.
Solución: actualizar a 3.7.31 o posterior.

Package	Affected versions	Patched versions
craftcms/cms Packagist	`≤ 3.7.31`	No fix yet
craft cms craftcms	`< 3.7.31`	`3.7.31`

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

NVD description

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≤ 3.7.31

No fix yet

< 3.7.31

3.7.31

Más vulnerabilidades de craftcms/cms

Ver todo →