CyberSecBulletin

Hasura vulnerabilities

We track 2 vulnerabilities in Hasura products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 14, 2023.

2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score

Latest Hasura vulnerabilities

  • 7.5 High severity

    graphql-engine: Improper Limitation of a Pathname to a Restricted Directory

    CVE-2023-27588HasuraEPSS 1.3%

    Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vuln

  • 8.8 High severity

    Graphql Engine: Incorrect Authorization

    CVE-2022-46792Hasura

    Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)