HIGH7.3
GHSA-wjg9-v8cf-f5q2
silverstripe/graphql Cross-Site Request Forgery vulnerability
Quick fix
GHSA-wjg9-v8cf-f5q2 — silverstripe/graphql: upgrade to the fixed version with the command below.
composer require silverstripe/graphql:^2.0.3Details
The GraphQL controller lacked any CSRF protection, meaning authenticated users could be forced or tricked into visiting a URL that would send a GET request to the affected web server that could mutate or destroy data without the user knowing.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/silverstripe/graphql
Introduced in:
2.0.0Fixed in: 2.0.3Fix
composer require silverstripe/graphql:^2.0.3References
- https://github.com/silverstripe/silverstripe-graphql/commit/b59ba397ff42d8934bd2d9c932514f898c327f64[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/SS-2018-007-1.yaml[WEB]
- https://github.com/silverstripe/silverstripe-graphql[PACKAGE]
- https://www.silverstripe.org/download/security-releases/ss-2018-007[WEB]