Lucene search

[email protected]CVE-2023-22477

HistoryJan 09, 2023 - 3:15 p.m.

CVE-2023-22477

2023-01-0915:15:11

NVD-CWE-Other

CWE-248

[email protected]

web.nvd.nist.gov

mercurius

graphql

fastify

denial of service

vulnerability

cve-2023-22477

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

35.3%

JSON

Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to /graphql. This issue was patched in #940. As a workaround, users can disable subscriptions.

CPENameOperatorVersion
mercurius_project:mercuriusmercurius project mercuriuslt8.13.2
mercurius_project:mercuriusmercurius project mercuriuseq8.11.0
mercurius_project:mercuriusmercurius project mercuriuseq3.0.5
mercurius_project:mercuriusmercurius project mercuriuseq3.6.0
mercurius_project:mercuriusmercurius project mercuriuseq5.3.0
mercurius_project:mercuriusmercurius project mercuriuseq8.1.3
mercurius_project:mercuriusmercurius project mercuriuseq6.9.0
mercurius_project:mercuriusmercurius project mercuriuseq8.13.1
mercurius_project:mercuriusmercurius project mercuriuseq7.3.0
mercurius_project:mercuriusmercurius project mercuriuseq8.0.0

CPE	Name	Operator	Version
mercurius_project:mercurius	mercurius project mercurius	lt	8.13.2
mercurius_project:mercurius	mercurius project mercurius	eq	8.11.0
mercurius_project:mercurius	mercurius project mercurius	eq	3.0.5
mercurius_project:mercurius	mercurius project mercurius	eq	3.6.0
mercurius_project:mercurius	mercurius project mercurius	eq	5.3.0
mercurius_project:mercurius	mercurius project mercurius	eq	8.1.3
mercurius_project:mercurius	mercurius project mercurius	eq	6.9.0
mercurius_project:mercurius	mercurius project mercurius	eq	8.13.1
mercurius_project:mercurius	mercurius project mercurius	eq	7.3.0
mercurius_project:mercurius	mercurius project mercurius	eq	8.0.0

Rows per page:

1-10 of 1361

References

github.com/mercurius-js/mercurius/issues/939

github.com/mercurius-js/mercurius/pull/940

github.com/mercurius-js/mercurius/security/advisories/GHSA-cm8h-q92v-xcfc

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

35.3%

JSON

Related for CVE-2023-22477

prion1 veracode1 osv2 github1