Incorrect Access Control vulnerability in api-platform/core
Moderate severity
GitHub Reviewed
Published
Oct 14, 2019
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Package
Affected versions
>= 2.2.0, < 2.2.10
>= 2.3.0, < 2.3.6
Patched versions
2.2.10
2.3.6
Description
Published by the National Vulnerability Database
Feb 4, 2019
Reviewed
Sep 25, 2019
Published to the GitHub Advisory Database
Oct 14, 2019
Last updated
Feb 1, 2023
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
References