CVE-2021-47714mediumCWE-89

Hasura GraphQL 1.3.3 Local File Read via SQL Injection

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.2%

probabilidade de exploração

0.2%top 91% das CVEs

exploração observada

nãonenhuma fonte reporta

Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attackers can exploit the pg_read_file() PostgreSQL function by crafting malicious SQL queries to read arbitrary files on the server.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Hasura · Hasura GraphQL

Referências

https://github.com/hasura/graphql-engine https://www.exploit-db.com/exploits/49790 https://www.vulncheck.com/advisories/hasura-graphql-local-file-read-via-sql-injection