MEDIUM6.5

GHSA-974j-wjxx-wggj

Incorrect Access Control vulnerability in api-platform/core

Quick fix

GHSA-974j-wjxx-wggj — api-platform/core: upgrade to the fixed version with the command below.

composer require api-platform/core:^2.2.10

Details

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/api-platform/core

Introduced in: 2.2.0Fixed in: 2.2.10

Fixcomposer require api-platform/core:^2.2.10

Packagist/api-platform/core

Introduced in: 2.3.0Fixed in: 2.3.6

Fixcomposer require api-platform/core:^2.3.6

References

https://nvd.nist.gov/vuln/detail/CVE-2019-1000011[ADVISORY]
https://github.com/api-platform/core/issues/2364[WEB]
https://github.com/api-platform/core/pull/2441[WEB]
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2019-1000011.yaml[WEB]