GHSA-p76j-h4m8-hx5c
Pimcore Demo Allows GraphQL Introspection
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | pimcore/demo | < 10.3.0 | 10.3.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Introspection is enabled on `demo.pimcore.fun`. The demo site has graphql as a feature for users, but allows users to run instropection queries, which presents a potential schema information disclosure vulnerability.
References
External links from the advisory. They lead to third-party sites.