CVE-2025-31485 (GCVE-0-2025-31485)

Vulnerability from cvelistv5 – Published: 2025-04-03 19:31 – Updated: 2025-04-08 13:15
VLAI
Title
GraphQL grant on a property might be cached with different objects
Summary
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-03 19:59 UTC
CWE
  • CWE-696 - Incorrect Behavior Order
Assigner
References
Impacted products
Vendor Product Version CPE status
api-platform core Affected: >= 4.0.0-alpha.1, < 4.0.22
Affected: < 3.4.17
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-31485",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-03T19:59:34.529256Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T19:59:57.790Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "api-platform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0-alpha.1, \u003c 4.0.22"
            },
            {
              "status": "affected",
              "version": "\u003c 3.4.17"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\\GraphQl\\Serializer\\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-696",
              "description": "CWE-696: Incorrect Behavior Order",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-08T13:15:23.510Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3"
        },
        {
          "name": "https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8"
        },
        {
          "name": "https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a"
        },
        {
          "name": "https://github.com/api-platform/core/releases/tag/v3.4.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/api-platform/core/releases/tag/v3.4.17"
        }
      ],
      "source": {
        "advisory": "GHSA-428q-q3vv-3fq3",
        "discovery": "UNKNOWN"
      },
      "title": "GraphQL grant on a property might be cached with different objects"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-31485",
    "datePublished": "2025-04-03T19:31:46.021Z",
    "dateReserved": "2025-03-28T13:36:51.298Z",
    "dateUpdated": "2025-04-08T13:15:23.510Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-31485",
      "date": "2026-09-28",
      "epss": "0.00603",
      "percentile": "0.46745"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "core",
                "vendor": "api-platform",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 4.0.0-alpha.1, \u003c 4.0.22"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 3.4.17"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\\GraphQl\\Serializer\\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17."
          },
          {
            "lang": "es",
            "value": "API Platform Core es un sistema para crear API REST y GraphQL basadas en hipermedia. Antes de la versi\u00f3n 4.0.22, una concesi\u00f3n GraphQL en una propiedad pod\u00eda almacenarse en cach\u00e9 con diferentes objetos. El m\u00e9todo ApiPlatform\\GraphQl\\Serializer\\ItemNormalizer::isCacheKeySafe() impide el almacenamiento en cach\u00e9, pero el m\u00e9todo parent::normalize, que se invoca posteriormente, sigue creando la clave de cach\u00e9 y causando el problema. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 4.0.22."
          }
        ],
        "id": "CVE-2025-31485",
        "lastModified": "2026-06-17T09:10:29.063",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-31485",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-03T19:59:34.529256Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-04-03T20:15:25.740",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/api-platform/core/releases/tag/v3.4.17"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-696"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T17:51:06+00:00",
      "cve": "CVE-2025-31485",
      "id": "CVE-2025-31485",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "GraphQL grant on a property might be cached with different objects",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-31485.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-31485",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-03T19:59:34.529256Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-04-03T19:59:44.724Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "core",
              "vendor": "api-platform",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 4.0.0-alpha.1, \u003c 4.0.22"
                },
                {
                  "status": "affected",
                  "version": "\u003c 3.4.17"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\\GraphQl\\Serializer\\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-696",
                  "description": "CWE-696: Incorrect Behavior Order",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-04-08T13:15:23.510Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3"
            },
            {
              "name": "https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8"
            },
            {
              "name": "https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a"
            },
            {
              "name": "https://github.com/api-platform/core/releases/tag/v3.4.17",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/api-platform/core/releases/tag/v3.4.17"
            }
          ],
          "source": {
            "advisory": "GHSA-428q-q3vv-3fq3",
            "discovery": "UNKNOWN"
          },
          "title": "GraphQL grant on a property might be cached with different objects"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-31485",
        "datePublished": "2025-04-03T19:31:46.021Z",
        "dateReserved": "2025-03-28T13:36:51.298Z",
        "dateUpdated": "2025-04-08T13:15:23.510Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.