api-platform

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

api-platform records in CISA KEV

No api-platform vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Core 2 records LOW

Records

2 records in Core · all components

TI-2023-10878 CVE-2023-25575 · GHSA-vr2x-7687-h6qv

Secured properties in API Platform Core may be accessible within collections

LOW 35

API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00604 Published 2023-02-28 Fixed in 3.0.12, 3.1.3 +1 CWE-842

TI-2019-15828 CVE-2019-1000011 · GHSA-974j-wjxx-wggj

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control…

LOW 31

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01024 Published 2019-02-04 Fixed in 2.2.10, 2.3.6 CWE-284

Open these records in search →

Critical	0
High	3
Medium	5
Low	0
No CVSS	0