GHSA-974j-wjxx-wggj

ghsaUSosv

Incorrect Access Control vulnerability in api-platform/core

view advisory published 2019-10-14Licence: CC-BY-4.0

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-1000011US	medium6.5	1.02% (63rd)	—	2019-02-04
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource ca…

references

External citations — patches, advisories, analysis.

https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2019-1000011.yamlWEB
https://github.com/api-platform/core/issues/2364WEB
https://github.com/api-platform/core/pull/2441WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-1000011ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan