Open mend-bolt-for-github[bot] opened 4 months ago
Core engine for Apollo GraphQL server
Library home page: https://registry.npmjs.org/apollo-server-core/-/apollo-server-core-2.4.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/apollo-server-core
Dependency Hierarchy: - cli-ui-4.0.0-alpha.0.tgz (Root Library) - vue-cli-plugin-apollo-0.19.2.tgz - apollo-server-express-2.4.8.tgz - :x: **apollo-server-core-2.4.8.tgz** (Vulnerable Library)
Found in HEAD commit: b9888ec61e269386b4fab790d7d16670ad49b548
Found in base branch: fix-babel-core-js
Apollo Server can log sensitive information (Studio API keys) if they are passed incorrectly (with leading/trailing whitespace) or if they have any characters that are invalid as part of a header value.
Publish Date: 2023-08-31
URL: WS-2023-0313
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-j5g3-5c8r-7qfx
Release Date: 2023-08-31
Fix Resolution (apollo-server-core): 2.26.1
Direct dependency fix Resolution (@vue/cli-ui): 4.0.0
Step up your Open Source Security Game with Mend here
WS-2023-0313 - Medium Severity Vulnerability
Core engine for Apollo GraphQL server
Library home page: https://registry.npmjs.org/apollo-server-core/-/apollo-server-core-2.4.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/apollo-server-core
Dependency Hierarchy: - cli-ui-4.0.0-alpha.0.tgz (Root Library) - vue-cli-plugin-apollo-0.19.2.tgz - apollo-server-express-2.4.8.tgz - :x: **apollo-server-core-2.4.8.tgz** (Vulnerable Library)
Found in HEAD commit: b9888ec61e269386b4fab790d7d16670ad49b548
Found in base branch: fix-babel-core-js
Apollo Server can log sensitive information (Studio API keys) if they are passed incorrectly (with leading/trailing whitespace) or if they have any characters that are invalid as part of a header value.
Publish Date: 2023-08-31
URL: WS-2023-0313
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-j5g3-5c8r-7qfx
Release Date: 2023-08-31
Fix Resolution (apollo-server-core): 2.26.1
Direct dependency fix Resolution (@vue/cli-ui): 4.0.0
Step up your Open Source Security Game with Mend here