CVE-2023-27588 - Vulnerability Details - OpenCVE

Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Hasura	Graphql Engine

Configuration 1 [-]

OR	cpe:2.3:a:hasura:graphql_engine::::::::
	cpe:2.3:a:hasura:graphql_engine::::::::
	cpe:2.3:a:hasura:graphql_engine::::::::

No data.

References

Link	Providers
https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158
https://github.com/hasura/graphql-engine/releases/tag/v1.3.4
https://github.com/hasura/graphql-engine/releases/tag/v2.11.5
https://github.com/hasura/graphql-engine/releases/tag/v2.20.1
https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1
https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x

History

Tue, 25 Feb 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-03-14T17:23:10.499Z

Updated: 2025-02-25T14:57:42.725Z

Reserved: 2023-03-04T01:03:53.635Z

Link: CVE-2023-27588

Vulnrichment

Updated: 2024-08-02T12:16:35.882Z

NVD

Status : Modified

Published: 2023-03-14T18:15:10.460

Modified: 2024-11-21T07:53:12.577

Link: CVE-2023-27588

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-27588", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-03-04T01:03:53.635Z", "datePublished": "2023-03-14T17:23:10.499Z", "dateUpdated": "2025-02-25T14:57:42.725Z"}, "containers": {"cna": {"title": "Unauthenticated path traversal vulnerability in Hasura GraphQL Engine", "problemTypes": [{"descriptions": [{"cweId": "CWE-27", "lang": "en", "description": "CWE-27: Path Traversal: 'dir/../../filename'", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x"}, {"name": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158", "tags": ["x_refsource_MISC"], "url": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158"}, {"name": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4"}, {"name": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5"}, {"name": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1"}, {"name": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1"}], "affected": [{"vendor": "hasura", "product": "graphql-engine", "versions": [{"version": "< 1.3.4", "status": "affected"}, {"version": ">= 2.0.0, < 2.11.5", "status": "affected"}, {"version": ">= 2.2.0, < 2.20.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-03-14T17:23:10.499Z"}, "descriptions": [{"lang": "en", "value": "Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch."}], "source": {"advisory": "GHSA-c9rw-rw2f-mj4x", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T12:16:35.882Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x"}, {"name": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158"}, {"name": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4"}, {"name": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5"}, {"name": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1"}, {"name": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-25T14:31:06.675110Z", "id": "CVE-2023-27588", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-25T14:57:42.725Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x", "name": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158", "name": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4", "name": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5", "name": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1", "name": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1", "name": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T12:16:35.882Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-27588", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-25T14:31:06.675110Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-25T14:31:08.145Z"}}], "cna": {"title": "Unauthenticated path traversal vulnerability in Hasura GraphQL Engine", "source": {"advisory": "GHSA-c9rw-rw2f-mj4x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "hasura", "product": "graphql-engine", "versions": [{"status": "affected", "version": "< 1.3.4"}, {"status": "affected", "version": ">= 2.0.0, < 2.11.5"}, {"status": "affected", "version": ">= 2.2.0, < 2.20.1"}]}], "references": [{"url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x", "name": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158", "name": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4", "name": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5", "name": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1", "name": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1", "name": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-27", "description": "CWE-27: Path Traversal: 'dir/../../filename'"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-03-14T17:23:10.499Z"}}}, "cveMetadata": {"cveId": "CVE-2023-27588", "state": "PUBLISHED", "dateUpdated": "2025-02-25T14:57:42.725Z", "dateReserved": "2023-03-04T01:03:53.635Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-03-14T17:23:10.499Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*", "matchCriteriaId": "966F6E14-F5DC-4610-95F4-19221345A44A", "versionEndExcluding": "1.3.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E8B2A1F-26DF-4160-A1ED-6803FC345C58", "versionEndExcluding": "2.11.5", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*", "matchCriteriaId": "9FCD45CF-6AE7-4EB5-B50F-2420E4167731", "versionEndExcluding": "2.20.1", "versionStartIncluding": "2.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch."}], "id": "CVE-2023-27588", "lastModified": "2024-11-21T07:53:12.577", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-03-14T18:15:10.460", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v1.3.4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.11.5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.20.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-27"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}