CVE-2019-1020015

2019-07-2913:15:12

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.1%

JSON

graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.

CPENameOperatorVersion
graphql-engineeq1.0.0-alpha31
graphql-engineeq1.0.0-alpha05
graphql-engineeq1.0.0-alpha09
graphql-engineeq1.0.0-alpha40
graphql-engineeq1.0.0-alpha12
graphql-engineeq1.0.0-alpha14
graphql-engineeq1.0.0-alpha28
graphql-engineeq1.0.0-alpha29
graphql-engineeq1.0.0-alpha45
graphql-engineeq1.0.0-alpha11

Name	Operator	Version
graphql-engine	eq	1.0.0-alpha31
graphql-engine	eq	1.0.0-alpha05
graphql-engine	eq	1.0.0-alpha09
graphql-engine	eq	1.0.0-alpha40
graphql-engine	eq	1.0.0-alpha12
graphql-engine	eq	1.0.0-alpha14
graphql-engine	eq	1.0.0-alpha28
graphql-engine	eq	1.0.0-alpha29
graphql-engine	eq	1.0.0-alpha45
graphql-engine	eq	1.0.0-alpha11