CVE-2023-27588highCWE-22CWE-27

CVE-2023-27588: falha de alta gravidade em hasura graphql-engine

Unauthenticated path traversal vulnerability in Hasura GraphQL Engine

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar graphql-engine

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 1.3%
Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
hasura · graphql-engine
CVEs relacionadas — hasura graphql-engine

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54698MEDIUMHasura: Row-level authorization bypass on table computed fieldsEPSS 0.3%