CVE-2023-34047low

CVE-2023-34047: falha de baixa gravidade em Spring for GraphQL

Exposure of data and identity to wrong session in Spring for GraphQL

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spring for GraphQL+ Monitorar org.springframework.graphql:spring-graphql

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.1epss 0.4%
A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Produtos afetados
Spring · Spring for GraphQL
CVEs relacionadas — Spring for GraphQL

No mesmo produto, das mais perigosas para as menos.

CVE-2026-59289HIGHSpring for GraphQL Denial of Service via pagination supportEPSS 0.5%CVE-2026-59285HIGHSpring for GraphQL Unsafe Deserialization in pagination supportEPSS 0.4%CVE-2026-41699HIGHUnsafe Deserialization in Spring GraphQLEPSS 0.4%CVE-2026-59288HIGHSpring for GraphQL Information Exposure in GraphiQL supportEPSS 0.4%CVE-2026-59287MEDIUMSpring for GraphQL WebSocket Client Denial of ServiceEPSS 0.4%CVE-2026-41856HIGHSpring GraphQL Annotation Detection VulnerabilityEPSS 0.4%