What is GHSA-p76j-h4m8-hx5c?

GHSA-p76j-h4m8-hx5c is a security advisory published by GitHub Security Advisories with Medium severity. Pimcore Demo Allows GraphQL Introspection

Which CVE IDs does GHSA-p76j-h4m8-hx5c cover?

GHSA-p76j-h4m8-hx5c covers the following CVE IDs: CVE-2023-5192. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p76j-h4m8-hx5c?

GHSA-p76j-h4m8-hx5c has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-p76j-h4m8-hx5c?

GHSA-p76j-h4m8-hx5c affects 1 product, including: composer/pimcore/demo:\u003c 10.3.0.

GHSA-p76j-h4m8-hx5cMediumCVSS 6.5

Pimcore Demo Allows GraphQL Introspection

Vendor

GitHub Security Advisories

Published

September 27, 2023

Last Modified

November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-5192 →

📋 Description

Introspection is enabled on demo.pimcore.fun. The demo site has graphql as a feature for users, but allows users to run instropection queries, which presents a potential schema information disclosure vulnerability.

🎯 Affected products1

composer/pimcore/demo:< 10.3.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-5192
https://github.com/pimcore/demo/commit/a2a7ff3b565882aefb759804aac4a51afb458f1f
https://huntr.dev/bounties/65c954f2-79c3-4672-8846-a3035e7a1db7
https://github.com/pimcore/demo/pull/437
https://github.com/advisories/GHSA-p76j-h4m8-hx5c