Silverstripe CSRF Protection Bypass via GraphQL

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2019-12437 · ADVISORY
• silverstripe/silverstripe-graphql commit 3c1dd6b · WEB
• silverstripe/silverstripe-graphql commit db28f30 · WEB
• FriendsOfPHP/security-advisories · WEB
• silverstripe/silverstripe-graphql · PACKAGE
• silverstripe.org/download/security-releases/cve-2019-12437 · WEB
• forum.silverstripe.org/c/releases · Release Notes
• silverstripe.org/blog/tag/release · Release Notes
• silverstripe.org/download/security-releases · Vendor Advisory

Lỗ hổng khác của silverstripe/graphql

• GHSA-wjg9-v8cf-f5q2CAO 7.3silverstripe/graphql Cross-Site Request Forgery vulnerability
• CVE-2023-44401TRUNG BÌNH 5.3The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to…
• CVE-2023-40180CAO 7.5 silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql quer…
• CVE-2023-28104CAO 7.5`silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially c…
• CVE-2021-28661TRUNG BÌNH 4.3Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.