← All advisories

Critical severity9.8NVD Advisory· Published Jun 25, 2024· Updated Jun 17, 2026

CVE-2024-37843

CVE-2024-37843

Description

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
craftcms/cmsPackagist	<= 3.7.31	—

Affected products

3

Craft/Craft CMSdescription
ghsa-coords
pkg:composer/craftcms/cms
Range: <= 3.7.31
Craftcms/Craft CMS
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
Range: <3.7.31

Patches

Vulnerability mechanics

References

3

github.com/advisories/GHSA-hq4f-mv3q-8wcvghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-37843ghsaADVISORY
blog.smithsecurity.biz/craft-cms-unauthenticated-sqli-via-graphqlnvdBroken LinkWEB

News mentions

0

No linked articles in our index yet.