« Volver al listado

CVE-2020-4038

Estado: ModificadaAlta (7.4)—

GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Prisma — Graphql-playground-htmlPrisma — Graphql-playground-middleware-expressPrisma — Graphql-playground-middleware-hapiPrisma — Graphql-playground-middleware-koaPrisma — Graphql-playground-middleware-lambda

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-4038",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "prisma-labs",
          "product": "graphql-playground",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.6.22"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-06-08T21:15:09.923",
  "references": [
    {
      "url": "https://github.com/prisma-labs/graphql-playground#security-details",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/prisma-labs/graphql-playground/commit/bf1883db538c97b076801a60677733816cb3cfb7",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/prisma-labs/graphql-playground/security/advisories/GHSA-4852-vrh7-28rf",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/prisma-labs/graphql-playground#security-details",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/prisma-labs/graphql-playground/commit/bf1883db538c97b076801a60677733816cb3cfb7",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/prisma-labs/graphql-playground/security/advisories/GHSA-4852-vrh7-28rf",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13."
    },
    {
      "lang": "es",
      "value": "GraphQL Playground (paquete Graphql-playground-html NPM) versión anterior a 1.6.22, presenta una grave vulnerabilidad de ataque de Reflexión XSS. Toda entrada de usuario no saneada que es pasada al método renderPlaygroundPage() podría desencadenar esta vulnerabilidad. Esto ha sido parcheado en graphql-playground-html versión 1.6.22. Tome en cuenta que algunos de los paquetes de middleware dependientes asociados también están afectados, incluidos, entre otros, graphql-playground-middleware-express versión anterior a 1.7.16, graphql-playground-middleware-koa versión anterior a 1.6.15, graphql-playground-middleware-lambda versión anterior a 1.7.17, y graphql-playground-middleware-hapi versión anterior a 1.6.13"
    }
  ],
  "lastModified": "2026-06-17T03:19:27.847",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:prisma:graphql-playground-html:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABADBEC8-9462-4D41-9CF2-AAE06F44B192",
              "versionEndExcluding": "1.6.22"
            },
            {
              "criteria": "cpe:2.3:a:prisma:graphql-playground-middleware-express:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8277C213-ED4A-495C-8F78-3A6BAB562EEA",
              "versionEndExcluding": "1.7.16"
            },
            {
              "criteria": "cpe:2.3:a:prisma:graphql-playground-middleware-hapi:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8FF9861D-5F51-4395-8399-B20E883D1AE4",
              "versionEndExcluding": "1.6.13"
            },
            {
              "criteria": "cpe:2.3:a:prisma:graphql-playground-middleware-koa:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2CEB6EE1-895A-4729-9E77-64B758B1F8A9",
              "versionEndExcluding": "1.6.15"
            },
            {
              "criteria": "cpe:2.3:a:prisma:graphql-playground-middleware-lambda:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2DF5937-B97F-4B80-9258-4F289B450F3E",
              "versionEndExcluding": "1.7.17"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}