[Security-news] GraphQL - Moderately critical - Information Disclosure - SA-CONTRIB-2021-013

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2021-013

Project: GraphQL [1]
Date: 2021-June-02
Security risk: *Moderately critical* 11∕25
AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2]
Vulnerability: Information Disclosure

Description: 
This module lets you craft and expose a GraphQL web service API.

The module does not sufficiently protect arbitrary exception and error
messages thereby exposing an information disclosure vulnerability.

This vulnerability is mitigated by the fact that a GraphQL server must be
enabled and a data producer be configured that throws exceptions with
confidential error messages that must not be exposed over the GraphQL API.

Solution: 
Install the latest version:

   * If you use the GraphQL module for Drupal 8.x, upgrade to GraphQL 8.x-4.1
     [3]

Reported By: 
   * Alex Tkachev [4]

Fixed By: 
   * Klaus Purer [5]
   * Radoslav Terezka [6]

Coordinated By: 
   * Greg Knaddison [7] of the Drupal Security Team


[1] https://www.drupal.org/project/graphql
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/graphql/releases/8.x-4.1
[4] https://www.drupal.org/user/390336
[5] https://www.drupal.org/user/262198
[6] https://www.drupal.org/user/741876
[7] https://www.drupal.org/user/36762