Description
birkir prime <= 0.4.0.beta.0 contains a cross-site request forgery vulnerability in its GraphQL endpoint that allows attackers to exploit GET-based query requests. Attackers can craft malicious GET requests to trigger unauthorized actions against privileged users by manipulating GraphQL query parameters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| birkir | prime | ≤ 0.4.0.beta.0 | — |
References
- GitHub Issue #547 issue-tracking
- VulnCheck Advisory: birkir prime <= 0.4.0.beta.0 - Cross-Site Request Forgery in GraphQL third-party-advisory