Skip to content
OpenAdvisories
High · 8.8 CVE-2019-12437 EUVD-2022-3848GHSA-fx37-56v6-85q6

Silverstripe CSRF Protection Bypass via GraphQL

Published Feb 19, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Package: silverstripe/graphql Ecosystem: Packagist

Description

In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist silverstripe/graphql >= 2.0.0, < 2.0.5 2.0.5 GHSA-fx37-56v6-85q6
Packagist silverstripe/graphql >= 3.1.0, < 3.1.2 3.1.2 GHSA-fx37-56v6-85q6

References