PT-2019-11630

CVE-2019-1020015

Published

2019-07-29

Updated

2021-07-21

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: graphql-engine (aka Hasura GraphQL Engine) versions prior to 1.0.0-beta.3

Description: The issue is related to the mishandling of the audience check while verifying JWT in the graphql-engine.

Recommendations: For versions prior to 1.0.0-beta.3, update to version 1.0.0-beta.3 or later to resolve the issue.

Exploitability

Fix

Vendors

Affected products

Related identifiers

Found an issue in the description? Have something to add? Feel free to write us 👾