CVE-2021-28661

Packagist/silverstripe/graphql CVE-2021-28661: medium 4.3, EPSS 0.81%

SilverStripe GraphQL Server permission checker not inherited by query subclass.

Action: Upgrade silverstripe/graphql to 3.5.2 or later.

composer require silverstripe/graphql:3.5.2

Affected

Fixed versions

Sources

• osv: GHSA-r7rh-g777-g5gx
• https://nvd.nist.gov/vuln/detail/CVE-2021-28661
• https://github.com/silverstripe/silverstripe-graphql/pull/407/commits/16961459f681f7b32145296189dfdbcc7715e6ed
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2021-28661.yaml
• https://github.com/silverstripe/silverstripe-graphql
• https://github.com/silverstripe/silverstripe-graphql/releases
• https://github.com/silverstripe/silverstripe-graphql/releases/tag/3.5.2
• https://www.silverstripe.org/download/security-releases/CVE-2021-28661

CVE-2021-28661 · published 2021-10-12T18:49:23Z · modified 2024-02-16T08:16:52.304414Z · JSON