DRUPAL-CONTRIB-2021-013

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/graphql/DRUPAL-CONTRIB-2021-013.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2021-013
Published
2021-06-02T16:56:19Z
Modified
2026-09-10T03:45:32Z
Summary
[none]
Details

This module lets you craft and expose a GraphQL web service API.

The module does not sufficiently protect arbitrary exception and error messages thereby exposing an information disclosure vulnerability.

This vulnerability is mitigated by the fact that a GraphQL server must be enabled and a data producer be configured that throws exceptions with confidential error messages that must not be exposed over the GraphQL API.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/graphql

Package

Name
drupal/graphql
Purl
pkg:composer/drupal/graphql?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Last Affected
4.0.0
Database specific
Show details 
{
    "constraint": "4.0.0"
}

Database specific

affected_versions 
"4.0.0"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/graphql/DRUPAL-CONTRIB-2021-013.json"