Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-23178 State: PUBLISHED Published: 2025-04-29T16:05:05.987Z Last Updated: 2025-04-29T17:56:25.515Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Ribbon Communications Products: Apollo 9608 Problem Types: CWE-923 Description: CWE-923: Improper Restriction of Communication Channel to Intended Endpoints Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-23179 State: PUBLISHED Published: 2025-04-29T16:09:12.121Z Last Updated: 2025-04-29T17:56:36.747Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Ribbon Communications Products: Apollo 9608 Problem Types: CWE-798 Description: CWE-798: Use of Hard-coded Credentials Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-23180 State: PUBLISHED Published: 2025-04-29T16:18:48.113Z Last Updated: 2025-04-29T17:45:07.981Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ribbon Communications Products: Apollo 9608 Problem Types: CWE-250 Description: CWE-250: Execution with Unnecessary Privileges Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-23181 State: PUBLISHED Published: 2025-04-29T16:19:37.077Z Last Updated: 2025-04-29T17:44:21.294Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ribbon Communications Products: Apollo 9608 Problem Types: CWE-250 Description: CWE-250: Execution with Unnecessary Privileges Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-23182 State: PUBLISHED Published: 2025-05-22T15:30:03.242Z Last Updated: 2025-05-22T15:57:53.417Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: UBtech Products: Freepass Problem Types: CWE-203 Description: CWE-203: Observable Discrepancy Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-23183 State: PUBLISHED Published: 2025-05-22T15:32:42.488Z Last Updated: 2025-05-22T15:56:34.724Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: UBtech Products: Freepass Problem Types: CWE-601 Description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE ID: CVE-2025-23184 State: PUBLISHED Published: 2025-01-21T09:35:37.468Z Last Updated: 2025-02-15T00:10:35.436Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Apache Software Foundation Products: Apache CXF Problem Types: CWE-400 Description: A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/lfs8l63rnctnj
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122
CVE ID: CVE-2025-23185 State: PUBLISHED Published: 2025-03-11T00:31:51.113Z Last Updated: 2025-03-11T02:17:05.919Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Business Objects Business Intelligence Platform Problem Types: CWE-209 Description: Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown to the user and in stack traces. Only an attacker with administrator level privileges has access to this disclosed information, and they could use it to craft further exploits. There is no impact on the integrity and availability of the app
mation, and they could use it to craft further exploits. There is no impact on the integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3549494 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-23186 State: PUBLISHED Published: 2025-04-08T07:10:22.346Z Last Updated: 2025-04-09T04:00:43.579Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP_SE Products: SAP NetWeaver Application Server ABAP Problem Types: CWE-94 Description: In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availab
promise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3554667 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-23187 State: PUBLISHED Published: 2025-02-11T00:33:10.032Z Last Updated: 2025-02-18T18:07:28.098Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver and ABAP Platform (SDCCN) Problem Types: CWE-862 Description: Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3546470 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-23188 State: PUBLISHED Published: 2025-03-11T00:32:01.809Z Last Updated: 2025-03-11T02:16:30.166Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP S/4HANA (RBD) Problem Types: CWE-862 Description: An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access to perform actions beyond their intended permissions. This causes a low impact on integrity with no impact on confidentiality and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3557131 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-23189 State: PUBLISHED Published: 2025-02-11T00:33:18.120Z Last Updated: 2025-02-11T15:18:55.445Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver and ABAP Platform (SDCCN) Problem Types: CWE-862 Description: Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3546470 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-23190 State: PUBLISHED Published: 2025-02-11T00:35:03.340Z Last Updated: 2025-02-11T16:01:38.164Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver and ABAP platform (ST-PI) Problem Types: CWE-862 Description: Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3547581 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-23191 State: PUBLISHED Published: 2025-02-11T00:35:15.392Z Last Updated: 2025-02-11T16:01:14.823Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP Fiori for SAP ERP Problem Types: CWE-644 Description: Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An attacker could alter the `atom:link` values in the returned metadata redirecting them from the SAP server to a malicious link set by the attacker. Successful exploitation could cause low impact on integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment
l exploitation could cause low impact on integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3426825 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-23192 State: PUBLISHED Published: 2025-06-10T00:10:12.042Z Last Updated: 2025-06-10T15:27:15.494Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: SAP_SE Products: SAP BusinessObjects Business Intelligence (BI Workspace) Problem Types: CWE-79 Description: SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session information, modify or make browser information unavailable. This leads to a high impact on confidentiali
sitive session information, modify or make browser information unavailable. This leads to a high impact on confidentiality and low impact on integrity, availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3560693 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-23193 State: PUBLISHED Published: 2025-02-11T00:35:25.783Z Last Updated: 2025-02-11T16:00:41.684Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Server ABAP Problem Types: CWE-204 Description: SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3561264 - https://url.sa
lity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3561264 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-23194 State: PUBLISHED Published: 2025-03-11T00:32:11.498Z Last Updated: 2025-03-11T02:13:53.935Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP_SE Products: SAP NetWeaver Enterprise Portal (OBN component) Problem Types: CWE-306 Description: SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-authenticated user can set it to an undesired value causing low impact on integrity. There is no impact on confidentiality or availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3561792 - https
e application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3561792 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2025-23195 State: PUBLISHED Published: 2025-01-21T21:22:33.286Z Last Updated: 2025-01-22T14:49:46.312Z Vendors: Apache Software Foundation Products: Apache Ambari Problem Types: CWE-611 Description: An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the `DocumentBuilderFactory` class without disabling external entity resolution. An attacker can exploit this vulnerability to read arbitrary files on the server or perform server-side request forgery (SSRF) attacks. The issue has been fixed in both Ambari 2.7.9 and the trunk branch. A
erform server-side request forgery (SSRF) attacks. The issue has been fixed in both Ambari 2.7.9 and the trunk branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/hsb6mvxd7g37dq1ygtd0pd88gs9tfcwq
CVE ID: CVE-2025-23196 State: PUBLISHED Published: 2025-01-21T21:23:41.389Z Last Updated: 2025-02-03T08:22:56.454Z Vendors: Apache Software Foundation Products: Apache Ambari Problem Types: CWE-77 Description: A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. The vulnerability arises when defining alert scripts, where the script filename field is executed using `sh -c`. An attacker with authenticated access can exploit this vulnerability to inject malicious commands, leading to remote code execution on the server. The issue has been fixed in the latest versions of Ambari. Additional Analy
ding to remote code execution on the server. The issue has been fixed in the latest versions of Ambari. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/70g1l5lxvko7kvhyxmtmklhhfrlon837
CVE ID: CVE-2025-23197 State: PUBLISHED Published: 2025-01-27T17:21:40.377Z Last Updated: 2025-02-12T20:41:35.629Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: matrix-org Products: matrix-hookshot Problem Types: CWE-754 Description: matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can crash on restart due to a missing check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to co
ng check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to connect their room to a repository. This vulnerability is fixed in 6.0.2 and 5.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-hookshot/security/advisories/GHSA-cr4q-jf47-3645 - https://github.com/matrix-org/matrix-hookshot/commit/e51d8210233ac759e7f7dfebc2c4f1bf6ce94802
CVE ID: CVE-2025-23198 State: PUBLISHED Published: 2025-01-16T22:26:25.873Z Last Updated: 2025-02-12T20:31:24.509Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):`/device/$DEVICE_ID/edit` -> param: display. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to
When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-pm8j-3v64-92cq
CVE ID: CVE-2025-23199 State: PUBLISHED Published: 2025-01-16T22:23:48.323Z Last Updated: 2025-02-12T20:31:24.634Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: `/ajax_form.php` -> param: descr. Librenms version up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been
malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-27vf-3g4f-6jp7
CVE ID: CVE-2025-23200 State: PUBLISHED Published: 2025-01-16T22:20:51.907Z Last Updated: 2025-02-12T20:31:24.753Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: `ajax_form.php` -> param: state. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been
malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-c66p-64fj-jmc2
CVE ID: CVE-2025-23201 State: PUBLISHED Published: 2025-01-16T22:18:51.754Z Last Updated: 2025-02-12T20:31:24.886Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: librenms Products: librenms Problem Types: CWE-79 Description: librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting (XSS) on the parameters:`/addhost` -> param: community. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This is
the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-g84x-g96g-rcjc
CVE ID: CVE-2025-23202 State: PUBLISHED Published: 2025-01-17T20:18:20.352Z Last Updated: 2025-02-12T20:31:25.262Z Vendors: devycreates Products: Bible-Module Problem Types: CWE-20 Description: Bible Module is a tool designed for ROBLOX developers to integrate Bible functionality into their games. The `FetchVerse` and `FetchPassage` functions in the Bible Module are susceptible to injection attacks due to the absence of input validation. This vulnerability could allow an attacker to manipulate the API request URLs, potentially leading to unauthorized access or data tampering. This issue has been addressed in version 0.0.3. All users are advised to upgrade. There are no known workarounds for
g. This issue has been addressed in version 0.0.3. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/devycreates/Bible-Module/security/advisories/GHSA-cm7w-99v2-prrq - https://github.com/devycreates/Bible-Module/commit/5b783855fc3285be2da8639c97ac37af28f8c55a
CVE ID: CVE-2025-23203 State: PUBLISHED Published: 2025-03-26T13:44:58.110Z Last Updated: 2025-05-02T16:02:38.737Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Icinga Products: icingaweb2-module-director Problem Types: CWE-200, CWE-284 Description: Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.3 and 1.11.3 on several director endpoints of REST API. To reproduce this vulnerability an authenticated user with permission to access the Director is required (plus api access with regard to the api endpoints). And even though some of these Icinga Director users are restrict
red (plus api access with regard to the api endpoints). And even though some of these Icinga Director users are restricted from accessing certain objects, are able to retrieve information related to them if their name is known. This makes it possible to change the configuration of these objects by those Icinga Director users restricted from accessing them. This results in further exploitation, data breaches and sensitive information disclosure. Affected endpoints include icingaweb2/director/service, if the host name is left out of the query; icingaweb2/directore/notification; icingaweb2/director/serviceset; and icingaweb2/director/scheduled-downtime. In addition, the endpoint `icingaweb2/dir
n; icingaweb2/director/serviceset; and icingaweb2/director/scheduled-downtime. In addition, the endpoint `icingaweb2/director/services?host=filteredHostName` returns a status code 200 even though the services for the host is filtered. This in turn lets the restricted user know that the host `filteredHostName` exists even though the user is restricted from accessing it. This could again result in further exploitation of this information and data breaches. Icinga Director has patches in versions 1.10.3 and 1.11.1. If upgrading is not feasible, disable the director module for the users other than admin role for the time being. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
the users other than admin role for the time being. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Icinga/icingaweb2-module-director/security/advisories/GHSA-3233-ggc5-m3qg - https://github.com/Icinga/icingaweb2-module-director/releases/tag/v1.10.3 - https://github.com/Icinga/icingaweb2-module-director/releases/tag/v1.11.3
CVE ID: CVE-2025-23204 State: PUBLISHED Published: 2025-03-24T15:53:19.156Z Last Updated: 2025-03-24T18:03:54.959Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: api-platform Products: core Problem Types: CWE-20 Description: API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl resolvers is always replaced by another one as there's no break in a clause. As this falls back to `security`, the impact is there only when there's only a security after resolver and none inside security. Version 3.3.15 contains a patch for the issue. Additional Analyst Notes: - CIS
after resolver and none inside security. Version 3.3.15 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/api-platform/core/security/advisories/GHSA-7mxx-3cgm-xxv3 - https://github.com/api-platform/core/pull/6444 - https://github.com/api-platform/core/pull/6444/files#diff-09e3c2cfe12a2ce65bd6c983c7ca6bfcf783f852b8d0554bb938e8ebf5e5fa65R56 - https://github.com/api-platform/core/commit/dc4fc84ba93e22b4f44a37e90a93c6d079c1c620 - https://github.com/soyuka/core/blob/7e2e8f9ff322ac5f6eb5f65baf432bffdca0fd51/src/Symfony/Security/State/AccessCheckerProvider.php#L49-L57