SilverStripe GraphQL Server permission checker not inherited by query subclass.

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-28661 · ADVISORY
• silverstripe/silverstripe-graphql#407 · WEB
• FriendsOfPHP/security-advisories · WEB
• silverstripe/silverstripe-graphql · PACKAGE
• silverstripe/silverstripe-graphql release · WEB
• silverstripe/silverstripe-graphql release 3.5.2 · WEB
• silverstripe.org/download/security-releases/CVE-2021-28661 · WEB

Autres vulnérabilités de silverstripe/graphql

• GHSA-wjg9-v8cf-f5q2ÉLEVÉE 7.3silverstripe/graphql Cross-Site Request Forgery vulnerability
• CVE-2023-44401MOYENNE 5.3The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to…
• CVE-2023-40180ÉLEVÉE 7.5 silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql quer…
• CVE-2023-28104ÉLEVÉE 7.5`silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially c…
• CVE-2020-26136MOYENNE 6.5In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.