Vulnerabilities > CVE-2020-4038 - Unspecified vulnerability in Prisma products

CVSS 7.4 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

prisma

NVD

Published: 2020-06-08

Updated: 2024-11-21

Summary

GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.

Vulnerable Configurations

Part	Description	Count
Application	Prisma Prisma Graphql Playground Middleware Hapi 1.1.2 Prisma Graphql Playground Middleware Hapi 1.1.3 Prisma Graphql Playground Middleware Hapi 1.1.4 Prisma Graphql Playground Middleware Hapi 1.2.0 Prisma Graphql Playground Middleware Hapi 1.2.1 Prisma Graphql Playground Middleware Hapi 1.3.0 Prisma Graphql Playground Middleware Hapi 1.3.1 Prisma Graphql Playground Middleware Hapi 1.3.5 Prisma Graphql Playground Middleware Hapi 1.3.6 Prisma Graphql Playground Middleware Hapi 1.3.7 Prisma Graphql Playground Middleware Hapi 1.3.8 Prisma Graphql Playground Middleware Hapi 1.4.0 Prisma Graphql Playground Middleware Hapi 1.5.0 Prisma Graphql Playground Middleware Hapi 1.5.1 Prisma Graphql Playground Middleware Hapi 1.5.2 Prisma Graphql Playground Middleware Hapi 1.6.0 Prisma Graphql Playground Middleware Hapi 1.6.1 Prisma Graphql Playground Middleware Hapi 1.6.2 Prisma Graphql Playground Middleware Hapi 1.6.10 Prisma Graphql Playground Middleware Hapi 1.6.11 Prisma Graphql Playground Middleware Hapi 1.6.12 Prisma Graphql Playground Middleware Lambda 1.1.2 Prisma Graphql Playground Middleware Lambda 1.1.3 Prisma Graphql Playground Middleware Lambda 1.1.4 Prisma Graphql Playground Middleware Lambda 1.2.0 Prisma Graphql Playground Middleware Lambda 1.2.1 Prisma Graphql Playground Middleware Lambda 1.3.0 Prisma Graphql Playground Middleware Lambda 1.3.1 Prisma Graphql Playground Middleware Lambda 1.3.5 Prisma Graphql Playground Middleware Lambda 1.3.6 Prisma Graphql Playground Middleware Lambda 1.3.7 Prisma Graphql Playground Middleware Lambda 1.3.8 Prisma Graphql Playground Middleware Lambda 1.3.9 Prisma Graphql Playground Middleware Lambda 1.3.10 Prisma Graphql Playground Middleware Lambda 1.4.0 Prisma Graphql Playground Middleware Lambda 1.4.1 Prisma Graphql Playground Middleware Lambda 1.4.2 Prisma Graphql Playground Middleware Lambda 1.4.3 Prisma Graphql Playground Middleware Lambda 1.4.4 Prisma Graphql Playground Middleware Lambda 1.5.0 Prisma Graphql Playground Middleware Lambda 1.5.1 Prisma Graphql Playground Middleware Lambda 1.6.0 Prisma Graphql Playground Middleware Lambda 1.6.1 Prisma Graphql Playground Middleware Lambda 1.7.0 Prisma Graphql Playground Middleware Lambda 1.7.1 Prisma Graphql Playground Middleware Lambda 1.7.2 Prisma Graphql Playground Middleware Lambda 1.7.3 Prisma Graphql Playground Middleware Lambda 1.7.4 Prisma Graphql Playground Middleware Lambda 1.7.5 Prisma Graphql Playground Middleware Lambda 1.7.6 Prisma Graphql Playground Middleware Lambda 1.7.7 Prisma Graphql Playground Middleware Lambda 1.7.8 Prisma Graphql Playground Middleware Lambda 1.7.9 Prisma Graphql Playground Middleware Lambda 1.7.10 Prisma Graphql Playground Middleware Lambda 1.7.11 Prisma Graphql Playground Middleware Lambda 1.7.12 Prisma Graphql Playground Middleware Lambda 1.7.13 Prisma Graphql Playground Middleware Lambda 1.7.14 Prisma Graphql Playground Middleware Lambda 1.7.15 Prisma Graphql Playground Middleware Lambda 1.7.16 Prisma Graphql Playground Middleware KOA 1.1.2 Prisma Graphql Playground Middleware KOA 1.1.3 Prisma Graphql Playground Middleware KOA 1.1.4 Prisma Graphql Playground Middleware KOA 1.2.0 Prisma Graphql Playground Middleware KOA 1.3.1 Prisma Graphql Playground Middleware KOA 1.3.5 Prisma Graphql Playground Middleware KOA 1.3.6 Prisma Graphql Playground Middleware KOA 1.3.7 Prisma Graphql Playground Middleware KOA 1.3.8 Prisma Graphql Playground Middleware KOA 1.4.0 Prisma Graphql Playground Middleware KOA 1.4.1 Prisma Graphql Playground Middleware KOA 1.4.2 Prisma Graphql Playground Middleware KOA 1.4.3 Prisma Graphql Playground Middleware KOA 1.5.0 Prisma Graphql Playground Middleware KOA 1.5.1 Prisma Graphql Playground Middleware KOA 1.6.0 Prisma Graphql Playground Middleware KOA 1.6.2 Prisma Graphql Playground Middleware KOA 1.6.3 Prisma Graphql Playground Middleware KOA 1.6.4 Prisma Graphql Playground Middleware KOA 1.6.5 Prisma Graphql Playground Middleware KOA 1.6.6 Prisma Graphql Playground Middleware KOA 1.6.7 Prisma Graphql Playground Middleware KOA 1.6.8 Prisma Graphql Playground Middleware KOA 1.6.9 Prisma Graphql Playground Middleware KOA 1.6.10 Prisma Graphql Playground Middleware KOA 1.6.11 Prisma Graphql Playground Middleware KOA 1.6.12 Prisma Graphql Playground Middleware KOA 1.6.13 Prisma Graphql Playground Middleware KOA 1.6.14 Prisma Graphql Playground Middleware Express 1.0.0 Prisma Graphql Playground Middleware Express 1.1.2 Prisma Graphql Playground Middleware Express 1.1.3 Prisma Graphql Playground Middleware Express 1.1.4 Prisma Graphql Playground Middleware Express 1.1.7 Prisma Graphql Playground Middleware Express 1.2.0 Prisma Graphql Playground Middleware Express 1.2.1 Prisma Graphql Playground Middleware Express 1.3.0 Prisma Graphql Playground Middleware Express 1.3.1 Prisma Graphql Playground Middleware Express 1.3.5 Prisma Graphql Playground Middleware Express 1.3.6 Prisma Graphql Playground Middleware Express 1.3.7 Prisma Graphql Playground Middleware Express 1.3.8 Prisma Graphql Playground Middleware Express 1.3.10 Prisma Graphql Playground Middleware Express 1.3.11 Prisma Graphql Playground Middleware Express 1.3.12 Prisma Graphql Playground Middleware Express 1.3.13 Prisma Graphql Playground Middleware Express 1.4.0 Prisma Graphql Playground Middleware Express 1.4.1 Prisma Graphql Playground Middleware Express 1.4.2 Prisma Graphql Playground Middleware Express 1.4.3 Prisma Graphql Playground Middleware Express 1.4.4 Prisma Graphql Playground Middleware Express 1.4.5 Prisma Graphql Playground Middleware Express 1.4.6 Prisma Graphql Playground Middleware Express 1.4.7 Prisma Graphql Playground Middleware Express 1.4.8 Prisma Graphql Playground Middleware Express 1.4.9 Prisma Graphql Playground Middleware Express 1.5.0 Prisma Graphql Playground Middleware Express 1.5.1 Prisma Graphql Playground Middleware Express 1.5.2 Prisma Graphql Playground Middleware Express 1.5.3 Prisma Graphql Playground Middleware Express 1.5.4 Prisma Graphql Playground Middleware Express 1.5.6 Prisma Graphql Playground Middleware Express 1.5.7 Prisma Graphql Playground Middleware Express 1.5.8 Prisma Graphql Playground Middleware Express 1.6.0 Prisma Graphql Playground Middleware Express 1.6.1 Prisma Graphql Playground Middleware Express 1.6.2 Prisma Graphql Playground Middleware Express 1.6.3 Prisma Graphql Playground Middleware Express 1.7.0 Prisma Graphql Playground Middleware Express 1.7.1 Prisma Graphql Playground Middleware Express 1.7.2 Prisma Graphql Playground Middleware Express 1.7.3 Prisma Graphql Playground Middleware Express 1.7.4 Prisma Graphql Playground Middleware Express 1.7.5 Prisma Graphql Playground Middleware Express 1.7.6 Prisma Graphql Playground Middleware Express 1.7.7 Prisma Graphql Playground Middleware Express 1.7.8 Prisma Graphql Playground Middleware Express 1.7.9 Prisma Graphql Playground Middleware Express 1.7.10 Prisma Graphql Playground Middleware Express 1.7.11 Prisma Graphql Playground Middleware Express 1.7.12 Prisma Graphql Playground Middleware Express 1.7.13 Prisma Graphql Playground Middleware Express 1.7.14 Prisma Graphql Playground Middleware Express 1.7.15 Prisma Graphql Playground Html 1.3.5 Prisma Graphql Playground Html 1.3.6 Prisma Graphql Playground Html 1.3.7 Prisma Graphql Playground Html 1.3.10 Prisma Graphql Playground Html 1.3.11 Prisma Graphql Playground Html 1.3.12 Prisma Graphql Playground Html 1.3.13 Prisma Graphql Playground Html 1.4.0 Prisma Graphql Playground Html 1.4.1 Prisma Graphql Playground Html 1.4.2 Prisma Graphql Playground Html 1.4.3 Prisma Graphql Playground Html 1.4.4 Prisma Graphql Playground Html 1.5.0 Prisma Graphql Playground Html 1.5.2 Prisma Graphql Playground Html 1.5.3 Prisma Graphql Playground Html 1.5.4 Prisma Graphql Playground Html 1.5.5 Prisma Graphql Playground Html 1.5.6 Prisma Graphql Playground Html 1.6.0 Prisma Graphql Playground Html 1.6.3 Prisma Graphql Playground Html 1.6.4 Prisma Graphql Playground Html 1.6.5 Prisma Graphql Playground Html 1.6.6 Prisma Graphql Playground Html 1.6.8 Prisma Graphql Playground Html 1.6.9 Prisma Graphql Playground Html 1.6.10 Prisma Graphql Playground Html 1.6.11 Prisma Graphql Playground Html 1.6.12 Prisma Graphql Playground Html 1.6.13 Prisma Graphql Playground Html 1.6.14 Prisma Graphql Playground Html 1.6.15 Prisma Graphql Playground Html 1.6.17 Prisma Graphql Playground Html 1.6.19 Prisma Graphql Playground Html 1.6.20 Prisma Graphql Playground Html 1.6.21	217

Summary

Vulnerable Configurations

References