GHSA-w3xg-7q6m-3xwp

Source

https://github.com/advisories/GHSA-w3xg-7q6m-3xwp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w3xg-7q6m-3xwp/GHSA-w3xg-7q6m-3xwp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w3xg-7q6m-3xwp

Aliases

CVE-2019-25060

Published

2022-05-10T00:00:20Z

Modified

2023-11-08T04:01:32Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Improper Access Control in wp-graphql

Details

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.

Database specific

{
    "cwe_ids":  [
        "CWE-284"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-05-25T19:38:28Z",
    "nvd_published_at":  "2022-05-09T17:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / wp-graphql/wp-graphql

Package

Name: wp-graphql/wp-graphql
Purl: pkg:composer/wp-graphql/wp-graphql

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.3.5

Affected versions

0.*

0.0.2

0.0.3

0.0.5

0.0.20

0.0.21

0.0.22

0.0.23

0.0.24

0.0.25

0.0.26

0.0.27

0.0.28

0.0.29

0.0.30

0.0.31

v0.*

v0.0.6

v0.0.7

v0.0.8

v0.0.9

v0.0.10

v0.0.11

v0.0.12

v0.0.13

v0.0.14

v0.0.15

v0.0.16

v0.0.17

v0.0.18

v0.0.19

v0.0.32

v0.0.33

v0.0.34

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.3.0

v0.3.01

v0.3.2

v0.3.3

v0.3.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w3xg-7q6m-3xwp/GHSA-w3xg-7q6m-3xwp.json"