CVE-2021-35970

2021-06-3015:15:10

Google

osv.dev

6.6 Medium

AI Score

Confidence

Low

0.007 Low

EPSS

Percentile

79.6%

JSON

Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an incorrect data type.

CPENameOperatorVersion
talkeq4.12.0
talkeq4.11.2
talkeq4.10.3
talkeq4.11.0
talkeq4.0.0
talkeq4.11.1
talkeq4.6.2
talkeq4.9.1
talkeq4.6.9
talkeq4.10.2

Name	Operator	Version
talk	eq	4.12.0
talk	eq	4.11.2
talk	eq	4.10.3
talk	eq	4.11.0
talk	eq	4.0.0
talk	eq	4.11.1
talk	eq	4.6.2
talk	eq	4.9.1
talk	eq	4.6.9
talk	eq	4.10.2

Rows per page:

1-10 of 501

References

docs.coralproject.net/coral/api/graphql/#User

github.com/coralproject/talk/compare/v4.12.0...v4.12.1

github.com/coralproject/talk/issues/3600

github.com/coralproject/talk/pull/3599