CVE-2019-1000011

Published February 4th, 2019

View on NVD ↗

CVSS v3

N/A

CVSS v2

5.5

MEDIUM

Affected

PROJECT

Description

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.

api-platform/core

The server component of API Platform: hypermedia and GraphQL APIs in minutes

GitHub

2.56K