Lucene search
Veracode Vulnerability DatabaseVERACODE:39516HistoryMar 04, 2023 - 9:57 p.m.
Information Disclosure
2023-03-0421:57:22
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
9
information disclosure
api-platform
core
vulnerability
resource properties
metadata
apiproperty
attribute
security option
apiplatform
bug
unauthorized users
authorized users
0.001 Low
EPSS
Percentile
27.8%
api-platform/core is vulnerable to Information Disclosure. Resource properties secured with the security option in the ApiPlatform\Metadata\ApiProperty attribute could be disclosed to unauthorized users when the option depends on the value of a property of the item. This bug can also hide properties that should be displayed to authorized users.
References
github.com/advisories/GHSA-vr2x-7687-h6qv
github.com/api-platform/core/commit/5723d68369722feefeb11e42528d9580db5dd0fb
github.com/api-platform/core/releases/tag/v2.7.10
github.com/api-platform/core/releases/tag/v3.0.12
github.com/api-platform/core/releases/tag/v3.1.3
github.com/api-platform/core/security/advisories/GHSA-vr2x-7687-h6qv
Related
osv
osv
CVE-2023-25575
2023-02-28 23:15:11
api-platform/core's secured properties may be accessible within collections
2023-02-28 23:25:54
cvelist
cvelist
friendsofphp
friendsofphp
CVE-2023-25575: Secured properties may be accessible within collections
2023-02-28 10:37:00
prion
prion
Design/Logic Flaw
2023-02-28 23:15:00
gitlab
gitlab
api-platform/core's secured properties may be accessible within collections
2023-02-28 00:00:00
github
github
api-platform/core's secured properties may be accessible within collections
2023-02-28 23:25:54
cve
cve
CVE-2023-25575
2023-02-28 23:15:11
nvd
nvd
CVE-2023-25575
2023-02-28 23:15:11