GHSA-fx37-56v6-85q6

Silverstripe CSRF Protection Bypass via GraphQL

Source: GitHub Advisory Database (reviewed) High CVE-2019-12437

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	silverstripe/graphql	>= 2.0.0, < 2.0.5	2.0.5
Packagist	silverstripe/graphql	>= 3.1.0, < 3.1.2	3.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

In SilverStripe/GraphQL prior to 2.0.5 and 3.1.2, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-12437 advisory
https://github.com/silverstripe/silverstripe-graphql/commit/3c1dd6b839b7c0e2cbc85074bb5840ebded6097c web
https://github.com/silverstripe/silverstripe-graphql/commit/db28f3075ae2335905f43ac808e9177497e354ff web
https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2019-12437.yaml web
https://github.com/silverstripe/silverstripe-graphql package
https://www.silverstripe.org/download/security-releases/cve-2019-12437 web