CVE-2019-1000011

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to…

published February 4, 2019

CVSS
—
EPSS
1%
Percentile
63.2
In the wild
Unconfirmed
What it is

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01024 · 63.2th percentile
Published
2019-02-04T21:00Z
EPSS history
Timeline
  • 04 FEB 21:00Z
    API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to…
    cvelistv5