Project:
Date:
2021-June-02
Security risk:
Vulnerability:
Information Disclosure
Affected versions:
4.0.0
Description:
This module lets you craft and expose a GraphQL web service API.
The module does not sufficiently protect arbitrary exception and error messages thereby exposing an information disclosure vulnerability.
This vulnerability is mitigated by the fact that a GraphQL server must be enabled and a data producer be configured that throws exceptions with confidential error messages that must not be exposed over the GraphQL API.
Solution:
Install the latest version:
- If you use the GraphQL module 8.x-4.x for Drupal 8.x, upgrade to GraphQL 8.x-4.1
- If you use the GraphQL module 8.x-3.x for Drupal 8.x no action is needed as a result of this advisory. The 8.x-3.x branch is not affected by this issue.
Reported By:
Fixed By:
Coordinated By:
- Greg Knaddison of the Drupal Security Team
