Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2019-12437 |
CWE-ID | CWE-352 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
SilverStripe GraphQL Server Server applications / Other server solutions |
Vendor | SilverStripe |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU25678
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2019-12437
CWE-ID:
CWE-352 - Cross-Site Request Forgery (CSRF)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin on GraphQL mutation queries. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
MitigationInstall update from vendor's website.
Vulnerable software versionsSilverStripe GraphQL Server: 2.0.0 - 3.0.4
CPE2.3 External linkshttp://forum.silverstripe.org/c/releases
http://www.silverstripe.org/blog/tag/release
http://www.silverstripe.org/download/security-releases/
http://snyk.io/vuln/SNYK-PHP-SILVERSTRIPEGRAPHQL-550160
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?