Vulnerability · Published Sep 20, 2023 · Assigned by vmware
CVE-2023-34047Exposure of data and identity to wrong session in Spring for GraphQL
Low 3.1
In plain English
A low-severity security flaw in Spring for GraphQL from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.4%top 63.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.graphql:spring-graphql | 1.1.6 | GHSA-frqc-f2h8-fjvf |
| Maven | org.springframework.graphql:spring-graphql | 1.2.3 | GHSA-frqc-f2h8-fjvf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring for GraphQL | 1.1.0 – before 1.1.61.2.0 – before 1.2.3 |