CVE-2024-50312mediumCWE-200

CVE-2024-50312: medium-severity vulnerability in Red Hat OpenShift Container Platform 4.16

Graphql: information disclosure via graphql introspection in openshift

Published · Updated

Follow this CVE+ Monitor Red Hat OpenShift Container Platform+ Monitor github.com/openshift/console

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.6%
A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Red Hat · Red Hat OpenShift Container Platform 4.16Red Hat · Red Hat OpenShift Container Platform 4.17Red Hat · Red Hat OpenShift Container Platform 4.18
Related CVEs — Red Hat OpenShift Container Platform 4.16

In the same product, most dangerous first.

CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-6409HIGHOpenssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9EPSS 27.9%CVE-2024-12085HIGHRsync: info leak via uninitialized stack contentsEPSS 8.6%CVE-2026-4408CRITICALSamba: remote code execution in samrEPSS 2.5%CVE-2024-7387CRITICALOpenshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategyEPSS 2.3%CVE-2026-33845HIGHGnutls: gnutls: denial of service via dtls zero-length fragmentEPSS 2.1%