Description

Acunetix determined that it was possible to access the Hasura GraphQL API without authentication. An unauthentication attacker may use this API to perform SSRF (Server-side request forgery) attacks.

Remediation

Restrict access to the Hasura GraphQL API by setting admin secret.

References

Server config examples

Related Vulnerabilities

WordPress 5.5.x Multiple Vulnerabilities (5.5 - 5.5.12)

Unrestricted access to Haproxy Data Plane API

WordPress Plugin Email newsletter 'option' Parameter Information Disclosure (8.0)

Drupal Core 6.x Information Disclosure (6.0 - 6.30)

Oracle applications logs publicy available

Severity

Medium

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Acumonitor SSRF