Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-31485

Good to know:

icon

Date: April 3, 2025

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17.

Severity Score

Related Resources (9)

https://nvd.nist.gov/vuln/detail/CVE-2025-31485
https://github.com/api-platform/core/releases/tag/v3.4.17
https://github.com/api-platform/core
https://github.com/api-platform/core/security/advisories/GHSA-428q-q3vv-3fq3
https://github.com/api-platform/core/commit/cba3acfbd517763cf320167250c5bed6d569696a
https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/graphql/CVE-2025-31485.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/api-platform/core/CVE-2025-31485.yaml
https://www.mend.io/vulnerability-database/CVE-2025-31485

Severity Score

Weakness Type (CWE)

Incorrect Behavior Order

CWE-696

Top Fix

icon

Upgrade Version

Upgrade to version api-platform/graphql - v4.0.22;api-platform/core - v4.0.22

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us