CVE-2019-1020015 Auth bypass in graphql-engine
Attackers can bypass authentication by exploiting improper JWT audience verification in Hasura GraphQL Engine.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-1020015?
CVE-2019-1020015 is a high-severity authentication bypass vulnerability in graphql-engine, published on 29 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.
Which versions are affected by CVE-2019-1020015?
It affects 1 product.
Products include Hasura Graphql Engine.
How do I fix CVE-2019-1020015?
No fix has been published for CVE-2019-1020015 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-1020015 being exploited?
There is no known exploitation of CVE-2019-1020015 in the wild and no public exploit code.
Other vulnerabilities in graphql-engine
- CVE-2021-47748 Hasura GraphQL 1.3.3 - Remote Code Execution
- CVE-2022-46792 Missing authorization in n/a
- CVE-2021-47713 Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query
- CVE-2023-27588 Unauthenticated path traversal vulnerability in Hasura GraphQL Engine
- CVE-2021-47714 Hasura GraphQL 1.3.3 Local File Read via SQL Injection
Sources
Also known as GHSA-xgqc-x32m-2j5c.