CVE-2019-1000011

EUVD-2019-0695
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 36%
Affected Products (NVD)
VendorProductVersion
api-platformcore
2.2.0 ≤
𝑥
≤ 2.3.5
𝑥
= Vulnerable software versions
References
https://github.com/api-platform/core/issues/2364
https://github.com/api-platform/core/pull/2441
https://github.com/api-platform/core/issues/2364
https://github.com/api-platform/core/pull/2441