CyberRota Analysis
AI-GeneratedThe Magefan Blog GraphQL for Magento 2 is vulnerable to information disclosure through the blogComments GraphQL query, allowing remote unauthenticated attackers to retrieve sensitive data, including blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql. This vulnerability poses a high risk of data exposure, making it critical for organizations using this module to prioritize immediate remediation efforts to safeguard user information. E-commerce platforms and developers utilizing this module should take action to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.
Related CVEs
Other vulnerabilities affecting the same vendor(s)