CVE-2023-47643
Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions.
Does this matter?
Lower severity and a low EPSS score (3.00%). Track it; it rarely justifies an emergency change on its own.
Description
SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire attack surface of the API, including sensitive fields such as UserHash. This issue is patched in version 8.4.2. There are no known workarounds.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 3.00% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- salesagility/suitecrm
- Source
- security-advisories@github.com
References
- https://github.com/salesagility/SuiteCRM-Core/commit/117dd8172793a239f71c91222606bf00677eeb33Patch
- https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-fxww-jqfv-9rrrExploit, Vendor Advisory
- https://www.apollographql.com/blog/graphql/security/why-you-should-disable-graphql-introspection-in-production/Technical Description
- https://github.com/salesagility/SuiteCRM-Core/commit/117dd8172793a239f71c91222606bf00677eeb33Patch
- https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-fxww-jqfv-9rrrExploit, Vendor Advisory
- https://www.apollographql.com/blog/graphql/security/why-you-should-disable-graphql-introspection-in-production/Technical Description
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.