GitHub Advisoryadvisory · Packagist

GHSA-qr97-v87p-x965 Ariadne Component Library vulnerable to Server-Side Request Forgery

CRITICAL Published 2022-12-31 Modified 2023-01-09 Official page ↗
Aliases
CVE-2017-20157
Ecosystem
Packagist
Packages
arc/web
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-918
Reviewed
2023-01-09

Affected packages

• Packagist arc/web: < 3.0 → fixed in 3.0

Description

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 can address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217140.

Related

Alias · CVE (1)

  • CVE-2017-20157 A vulnerability was found in Ariadne Component Library up to 2.x. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References