CVE-2023-34047low

Exposure of data and identity to wrong session in Spring for GraphQL

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.1epss 0.4%

probabilidade de exploração

0.4%top 64% das CVEs

exploração observada

nãonenhuma fonte reporta

A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Produtos afetados

Spring · Spring for GraphQL

Referências

https://spring.io/security/cve-2023-34047