NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Composer (PHP)

CVE-2024-37843: Craft CMS SQL injection vulnerability via the GraphQL API endpoint

criticalCVSS 4.0 9.3 · 3.1 9.8GHSA-hq4f-mv3q-8wcv

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

Published Jun 25, 2024 · Updated Aug 2, 2024

Affected packages

craftcms/cms

Ecosystem
Composer (PHP)
Affected
<= 3.7.31
Fixed in
No patched version yet
Check
composer show craftcms/cms

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Composer (PHP) vulnerabilities

All Composer (PHP) entries