CVE-2021-28661 — Incorrect Authorization in Graphql

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 61.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Silverstripe GraphqlSilverstripe
Timeline
PublishedOct 7
Latest updateOct 12

Description

Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶Packagistsilverstripe/graphql3.0.0 — 3.5.2
▶NVDsilverstripe/silverstripe3.0.0 — 3.4.1

🔴Vulnerability Details

2
GHSA
SilverStripe GraphQL Server permission checker not inherited by query subclass.↗2021-10-12
▶
OSV
SilverStripe GraphQL Server permission checker not inherited by query subclass.↗2021-10-12
▶
CVE-2021-28661 — Incorrect Authorization in Graphql | cvebase