Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Silverstripe GraphQL may accept forged requests

CVE-2019-12437 · published 6 years ago
Summary

Versions of Silverstripe up to 4.3.3, including its GraphQL component, can let an attacker send actions that appear to come from a legitimate user. This could let someone change data or perform operations without proper permission. Update to the latest Silverstripe release or apply the provided security patch to close the gap.

What to do
  • Update silverstripe graphql to version 2.0.5.
  • Update silverstripe graphql to version 3.1.2.
Affected software
Ecosystem VendorProductAffected versions
composer silverstripe graphql >= 2.0.0, < 2.0.5
>= 3.1.0, < 3.1.2
Fix: upgrade to 2.0.5
– silverstripe silverstripe <= 4.3.3
cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*
Original advisory text
Silverstripe CSRF Protection Bypass via GraphQL
In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published19 Feb 2020
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-fx37-56v6-85q6 · GHSA
CVE-2019-12437 · NVD
Track software like this
Free during beta