What is GHSA-287f-46j7-j4wh?

GHSA-287f-46j7-j4wh is a security advisory published by GitHub Security Advisories with Medium severity. Umbraco Workflow's Backoffice users can execute arbitrary SQL

Which CVE IDs does GHSA-287f-46j7-j4wh cover?

GHSA-287f-46j7-j4wh covers the following CVE IDs: CVE-2024-32872. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-287f-46j7-j4wh?

GHSA-287f-46j7-j4wh has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

Which products are affected by GHSA-287f-46j7-j4wh?

GHSA-287f-46j7-j4wh affects 4 products, including: nuget/Umbraco.Workflow:\u003c 10.3.9; nuget/Umbraco.Workflow:\u003e= 11.0.0-rc1, \u003c 12.2.6; nuget/Umbraco.Workflow:\u003e= 13.0.0-rc1, \u003c 13.0.6; nuget/Plumber.Workflow:\u003c 10.1.2.

GHSA-287f-46j7-j4whMediumCVSS 5.5

Umbraco Workflow's Backoffice users can execute arbitrary SQL

Vendor

GitHub Security Advisories

Published

April 24, 2024

Last Modified

April 24, 2024

🔗 CVE IDs covered (1)

CVE-2024-32872 →

📋 Description

Impact

Backoffice users can execute arbitrary SQL.

Explanation of the vulnerability

A Backoffice user can modify requests to a particular API endpoint to include SQL which will be executed by the server.

Affected versions

All versions

Patches

Workflow 10.3.9, 12.2.6, 13.0.6, Plumber 10.1.2

References

Upgrading Umbraco Workflow

🎯 Affected products4

nuget/Umbraco.Workflow:< 10.3.9
nuget/Umbraco.Workflow:>= 11.0.0-rc1, < 12.2.6
nuget/Umbraco.Workflow:>= 13.0.0-rc1, < 13.0.6
nuget/Plumber.Workflow:< 10.1.2

🔗 References (3)

https://github.com/umbraco/Umbraco.Workflow.Issues/security/advisories/GHSA-287f-46j7-j4wh
https://nvd.nist.gov/vuln/detail/CVE-2024-32872
https://github.com/advisories/GHSA-287f-46j7-j4wh