{"action":"Upgrade apollo-server to 2.25.4 or later.","affected":[{"fixed":"2.25.4","introduced":"2.0.0"}],"component":"apollo-server","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2.25.4"],"ghsa_id":"GHSA-2p3c-p3qw-69r4","id":"tcs_01M5KETPPYZ7WW30PMP1YD1M6T","modified_at":"2023-07-31T20:39:03Z","published_at":"2022-10-12T14:15:48Z","references":["https://osv.dev/vulnerability/GHSA-2p3c-p3qw-69r4","https://github.com/apollographql/apollo-server/security/advisories/GHSA-2p3c-p3qw-69r4","https://github.com/jaydenseric/graphql-multipart-request-spec/pull/64","https://github.com/apollographql/apollo-server/commit/82d44985ddca8e61557957d67f41e9c1a705a5ca","https://github.com/apollographql/apollo-server"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-2p3c-p3qw-69r4","url":"https://osv.dev/vulnerability/GHSA-2p3c-p3qw-69r4"}],"summary":"The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations"}