CVE-2020-4038
Summary
| CVE | CVE-2020-4038 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-06-08 21:15:00 UTC |
|---|
| Updated | 2020-06-12 14:38:00 UTC |
|---|
| Description | GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| GitHub - prisma-labs/graphql-playground: ???? GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration) |
MISC |
github.com |
Third Party Advisory |
| Merge pull request from GHSA-4852-vrh7-28rf · graphql/graphql-playground@bf1883d · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Reflected XSS in GraphQL Playground React, HTML and Middlewares · Advisory · graphql/graphql-playground · GitHub |
CONFIRM |
github.com |
Mitigation, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 980213 Nodejs (npm) Security Update for graphql-playground-html (GHSA-4852-vrh7-28rf)
