Lookup for vulnerable packages by Package URL.
| Purl | pkg:npm/apollo-server-fastify@2.7.2 |
| Type | npm |
| Namespace | |
| Name | apollo-server-fastify |
| Version | 2.7.2 |
| Qualifiers |
|
| Subpath | |
| Is_vulnerable | true |
| Next_non_vulnerable_version | 2.14.2 |
| Latest_non_vulnerable_version | 2.14.2 |
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-u2b9-99j7-rkbk |
| vulnerability_id |
VCID-u2b9-99j7-rkbk |
| summary |
Introspection in schema validation in Apollo Server
If `subscriptions: false` is passed to the `ApolloServer` constructor options, there is no impact. If implementors were not expecting validation rules to be enforced on the WebSocket subscriptions transport **and** are unconcerned about introspection being enabled on the WebSocket subscriptions transport (or were not expecting that), then this advisory is not applicable. If `introspection: true` is passed to the `ApolloServer` constructor options, the impact is limited to user-provided validation rules (i.e., using `validationRules`) since there would be no expectation that introspection was disabled. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
|
| fixed_packages |
|
| aliases |
GHSA-w42g-7vfc-xf37, GMS-2020-59, GMS-2020-60, GMS-2020-61, GMS-2020-62, GMS-2020-63, GMS-2020-64, GMS-2020-65, GMS-2020-66, GMS-2020-67, GMS-2020-68, GMS-2020-69, GMS-2020-70
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u2b9-99j7-rkbk |
|
|
| Fixing_vulnerabilities |
|
| Risk_score | 3.1 |
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:npm/apollo-server-fastify@2.7.2 |