Medium · 4.3 CVE-2021-28661 BIT-silverstripe-2021-28661EUVD-2021-2253GHSA-r7rh-g777-g5gx

SilverStripe GraphQL Server permission checker not inherited by query subclass.

Published Oct 7, 2021 · Updated Aug 3, 2024 · Assigned by mitre

Description

Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.

Ecosystem	Package	Affected	Fixed	Record
Packagist	silverstripe/graphql	>= 3.0.0, < 3.5.2	3.5.2	GHSA-r7rh-g777-g5gx