Cross-Site Request Forgery (CSRF) Affecting strawberry-graphql package, versions [,0.243.0)
Threat Intelligence
EPSS
0.06% (28th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-STRAWBERRYGRAPHQL-8097218
- published 26 Sep 2024
- disclosed 25 Sep 2024
- credit Speedy1991,Thomas Grainger
Introduced: 25 Sep 2024
CVE-2024-47082 Open this link in a new tabHow to fix?
Upgrade strawberry-graphql to version 0.243.0 or higher.
Overview
strawberry-graphql is an A library for creating GraphQL APIs
Affected versions of this package are vulnerable to Cross-Site Request Forgery (CSRF) due to the default settings of exemption from Django's CsrfViewMiddleware protection and support for multipart file uploads, in all integrations.
Note: After the fix, clients need to send CSRF tokens with every request.