Vulnerabilites related to hasura - graphql_engine
CVE-2022-46792 (GCVE-0-2022-46792)
Vulnerability from cvelistv5
Published
2022-12-08 00:00
Modified
2025-04-23 14:25
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Summary
Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:39:38.724Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUU"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-g7mj-g7f4-hgrg"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-46792",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T14:25:05.472991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-863",
                "description": "CWE-863 Incorrect Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T14:25:42.452Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-08T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUU"
        },
        {
          "url": "https://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0/"
        },
        {
          "url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-g7mj-g7f4-hgrg"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-46792",
    "datePublished": "2022-12-08T00:00:00.000Z",
    "dateReserved": "2022-12-08T00:00:00.000Z",
    "dateUpdated": "2025-04-23T14:25:42.452Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-27588 (GCVE-0-2023-27588)
Vulnerability from cvelistv5
Published
2023-03-14 17:23
Modified
2025-02-25 14:57
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-27 - Path Traversal: 'dir/../../filename'
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.
References
Impacted products
Vendor Product Version
hasura graphql-engine Version: < 1.3.4
Version: >= 2.0.0, < 2.11.5
Version: >= 2.2.0, < 2.20.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:16:35.882Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x"
          },
          {
            "name": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158"
          },
          {
            "name": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4"
          },
          {
            "name": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5"
          },
          {
            "name": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1"
          },
          {
            "name": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-27588",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-25T14:31:06.675110Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-25T14:57:42.725Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graphql-engine",
          "vendor": "hasura",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.11.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.20.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-27",
              "description": "CWE-27: Path Traversal: \u0027dir/../../filename\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-14T17:23:10.499Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x"
        },
        {
          "name": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158"
        },
        {
          "name": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4"
        },
        {
          "name": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5"
        },
        {
          "name": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1"
        },
        {
          "name": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1"
        }
      ],
      "source": {
        "advisory": "GHSA-c9rw-rw2f-mj4x",
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated path traversal vulnerability in Hasura GraphQL Engine"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-27588",
    "datePublished": "2023-03-14T17:23:10.499Z",
    "dateReserved": "2023-03-04T01:03:53.635Z",
    "dateUpdated": "2025-02-25T14:57:42.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-1020015 (GCVE-0-2019-1020015)
Vulnerability from cvelistv5
Published
2019-07-29 12:21
Modified
2024-08-05 03:14
Severity ?
CWE
  • mishandles the audience check
Summary
graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.
References
Impacted products
Vendor Product Version
graphql-engine graphql-engine Version: < 1.0.0-beta.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:14:16.238Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291ac"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graphql-engine",
          "vendor": "graphql-engine",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.0-beta.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "mishandles the audience check",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-29T12:21:40",
        "orgId": "7556d962-6fb7-411e-85fa-6cd62f095ba8",
        "shortName": "dwf"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291ac"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-assign@distributedweaknessfiling.org",
          "ID": "CVE-2019-1020015",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "graphql-engine",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.0.0-beta.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "graphql-engine"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "mishandles the audience check"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291ac",
              "refsource": "MISC",
              "url": "https://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291ac"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7556d962-6fb7-411e-85fa-6cd62f095ba8",
    "assignerShortName": "dwf",
    "cveId": "CVE-2019-1020015",
    "datePublished": "2019-07-29T12:21:40",
    "dateReserved": "2019-07-26T00:00:00",
    "dateUpdated": "2024-08-05T03:14:16.238Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2019-07-29 13:15
Modified
2024-11-21 04:18
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.
References
josh@bress.nethttps://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291acPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291acPatch, Third Party Advisory
Impacted products
Vendor Product Version
hasura graphql_engine *
hasura graphql_engine 1.0.0
hasura graphql_engine 1.0.0
hasura graphql_engine 1.0.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6992CBD9-75D2-4C4B-9219-B61111016195",
              "versionEndExcluding": "1.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:1.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "F476564A-C527-449E-A0EC-1D286D3C507B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:1.0.0:beta.1:*:*:*:*:*:*",
              "matchCriteriaId": "711E4956-23AC-428A-9FBE-A07F774C9810",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:1.0.0:beta.2:*:*:*:*:*:*",
              "matchCriteriaId": "2DD19C5C-B0AA-4C4D-8587-635CF0F2DC13",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT."
    },
    {
      "lang": "es",
      "value": "graphql-engine (tambi\u00e9n se conoce como Hasura GraphQL Engine) anterior a versi\u00f3n 1.0.0-beta.3, maneja inapropiadamente la comprobaci\u00f3n de audiencia mientras se verifica JWT."
    }
  ],
  "id": "CVE-2019-1020015",
  "lastModified": "2024-11-21T04:18:11.747",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-07-29T13:15:12.090",
  "references": [
    {
      "source": "josh@bress.net",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291ac"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291ac"
    }
  ],
  "sourceIdentifier": "josh@bress.net",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-12-08 06:15
Modified
2025-04-23 15:15
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)
References
cve@mitre.orghttps://github.com/hasura/graphql-engine/security/advisories/GHSA-g7mj-g7f4-hgrgPatch, Third Party Advisory
cve@mitre.orghttps://groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUUMailing List, Patch, Third Party Advisory
cve@mitre.orghttps://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0/Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/hasura/graphql-engine/security/advisories/GHSA-g7mj-g7f4-hgrgPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUUMailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0/Mitigation, Vendor Advisory
Impacted products
Vendor Product Version
hasura graphql_engine *
hasura graphql_engine *
hasura graphql_engine *
hasura graphql_engine *
hasura graphql_engine 2.12.0
hasura graphql_engine 2.12.0
hasura graphql_engine 2.14.0
hasura graphql_engine 2.14.0
hasura graphql_engine 2.14.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B705C96-0584-4CC1-B9EF-B69C3F84E829",
              "versionEndExcluding": "2.10.2",
              "versionStartIncluding": "2.10.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "908BE462-E73A-4C41-9BBA-F64775943548",
              "versionEndExcluding": "2.11.3",
              "versionStartIncluding": "2.11.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B6B35B16-2DC0-460D-823B-6A8204658A70",
              "versionEndExcluding": "2.13.2",
              "versionStartIncluding": "2.13.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D67188D-9C00-4D33-BD2C-141AB3FE8FD3",
              "versionEndExcluding": "2.15.2",
              "versionStartIncluding": "2.15.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:2.12.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "5610371D-1DAB-48E6-9701-A07D52806573",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:2.12.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "73834859-46F0-455C-B285-7D93E8BE0C92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:2.14.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "E32B6C3F-3E7A-4574-AC8F-B1605AD0009D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:2.14.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "19839FF4-1613-4564-9DB6-E55DA364F73A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:2.14.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "62B619A6-3194-4982-A273-A461F7728619",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)"
    },
    {
      "lang": "es",
      "value": "Hasura GraphQL Engine anterior a 2.15.2 maneja mal la autorizaci\u00f3n a nivel de fila en Update Many API para backends de Postgres. Las versiones corregidas son 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1 y 2.15.2. (Las versiones anteriores a la 2.10.0 no se ven afectadas)."
    }
  ],
  "id": "CVE-2022-46792",
  "lastModified": "2025-04-23T15:15:58.753",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2022-12-08T06:15:08.940",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-g7mj-g7f4-hgrg"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUU"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-g7mj-g7f4-hgrg"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUU"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2023-03-14 18:15
Modified
2024-11-21 07:53
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.
References
security-advisories@github.comhttps://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158Patch
security-advisories@github.comhttps://github.com/hasura/graphql-engine/releases/tag/v1.3.4Release Notes
security-advisories@github.comhttps://github.com/hasura/graphql-engine/releases/tag/v2.11.5Release Notes
security-advisories@github.comhttps://github.com/hasura/graphql-engine/releases/tag/v2.20.1Release Notes
security-advisories@github.comhttps://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1Release Notes
security-advisories@github.comhttps://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4xVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/hasura/graphql-engine/releases/tag/v1.3.4Release Notes
af854a3a-2127-422b-91ae-364da2661108https://github.com/hasura/graphql-engine/releases/tag/v2.11.5Release Notes
af854a3a-2127-422b-91ae-364da2661108https://github.com/hasura/graphql-engine/releases/tag/v2.20.1Release Notes
af854a3a-2127-422b-91ae-364da2661108https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1Release Notes
af854a3a-2127-422b-91ae-364da2661108https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4xVendor Advisory
Impacted products
Vendor Product Version
hasura graphql_engine *
hasura graphql_engine *
hasura graphql_engine *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "966F6E14-F5DC-4610-95F4-19221345A44A",
              "versionEndExcluding": "1.3.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E8B2A1F-26DF-4160-A1ED-6803FC345C58",
              "versionEndExcluding": "2.11.5",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FCD45CF-6AE7-4EB5-B50F-2420E4167731",
              "versionEndExcluding": "2.20.1",
              "versionStartIncluding": "2.12.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch."
    }
  ],
  "id": "CVE-2023-27588",
  "lastModified": "2024-11-21T07:53:12.577",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-03-14T18:15:10.460",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-27"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}