CVE-2024-47082
2 advisories.
PyPI/strawberry-graphql CVE-2024-47082: medium 4.6
Cross-Site Request Forgery (CSRF) in strawberry-graphql
Action: Upgrade strawberry-graphql to 0.243.0 or later.
pip install strawberry-graphql==0.243.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.243.0 | - |
Fixed versions
| 0.243.0 |
Sources
- osv: GHSA-79gp-q4wv-33fr
- https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-79gp-q4wv-33fr
- https://nvd.nist.gov/vuln/detail/CVE-2024-47082
- https://github.com/strawberry-graphql/strawberry/commit/37265b230e511480a9ceace492f9f6a484be1387
- https://github.com/pypa/advisory-database/tree/main/vulns/strawberry-graphql/PYSEC-2024-171.yaml
- https://github.com/strawberry-graphql/strawberry
- https://strawberry.rocks/docs/breaking-changes/0.243.0
CVE-2024-47082 · published · modified · JSON
PyPI/strawberry-graphql CVE-2024-47082: high 8
Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in a
Action: Upgrade strawberry-graphql to 0.243.0 or later.
pip install strawberry-graphql==0.243.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.243.0 | - |
Fixed versions
| 0.243.0 |
Sources
- osv: PYSEC-2024-171
- https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-79gp-q4wv-33fr
- https://github.com/strawberry-graphql/strawberry/commit/37265b230e511480a9ceace492f9f6a484be1387
- https://strawberry.rocks/docs/breaking-changes/0.243.0
CVE-2024-47082 · published · modified · JSON