Vulnerability · Published Mar 27, 2023 · Assigned by mitre
CVE-2023-28867
High 7.5
In plain English
A high-severity security flaw in the com.graphql-java:graphql-java package (Maven). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.1%top 35.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.graphql-java:graphql-java | 0.0.0-2023-03-20T01-49-44-80e3135 | GHSA-p4qx-6w5p-4rj2 |
| Maven | com.graphql-java:graphql-java | 17.5 | GHSA-p4qx-6w5p-4rj2 |
| Maven | com.graphql-java:graphql-java | 18.4 | GHSA-p4qx-6w5p-4rj2 |
| Maven | com.graphql-java:graphql-java | 19.4 | GHSA-p4qx-6w5p-4rj2 |
| Maven | com.graphql-java:graphql-java | 20.1 | GHSA-p4qx-6w5p-4rj2 |
Affected products (as reported)
References
- https://github.com/graphql-java/graphql-java/pull/3112
- https://github.com/graphql-java/graphql-java/releases/tag/v17.5
- https://github.com/graphql-java/graphql-java/releases/tag/v18.4
- https://github.com/graphql-java/graphql-java/releases/tag/v19.4
- https://github.com/graphql-java/graphql-java/releases/tag/v20.1