Lucene search

PRIOn knowledge basePRION:CVE-2022-46792

HistoryDec 08, 2022 - 6:15 a.m.

Hardcoded credentials

2022-12-0806:15:00

PRIOn knowledge base

www.prio-n.com

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

45.1%

JSON

Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)

CPENameOperatorVersion
graphql_enginege2.15.0
graphql_enginelt2.15.2
graphql_engineeq2.14.0
graphql_engineeq2.14.0 beta1
graphql_engineeq2.14.0 beta2
graphql_enginege2.13.0
graphql_enginelt2.13.2
graphql_engineeq2.12.0 beta1
graphql_engineeq2.12.0
graphql_enginege2.11.0

Name	Operator	Version
graphql_engine	ge	2.15.0
graphql_engine	lt	2.15.2
graphql_engine	eq	2.14.0
graphql_engine	eq	2.14.0 beta1
graphql_engine	eq	2.14.0 beta2
graphql_engine	ge	2.13.0
graphql_engine	lt	2.13.2
graphql_engine	eq	2.12.0 beta1
graphql_engine	eq	2.12.0
graphql_engine	ge	2.11.0

Rows per page:

1-10 of 131

References

github.com/hasura/graphql-engine/security/advisories/GHSA-g7mj-g7f4-hgrg

groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUU

hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0/

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

45.1%

JSON

Related for PRION:CVE-2022-46792