PT-2023-24654 · Spring · Spring For Graphql

Jack Rowland · Published 2023-09-20 · Updated 2024-11-08 · CVE-2023-34047

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 1.1.0 through 1.1.5 Spring for GraphQL versions 1.2.0 through 1.2.2

Description A batch loader function in Spring for GraphQL may be exposed to GraphQL context with values, including security context values, from a different session. This issue arises when an application provides a DataLoaderOptions instance while registering batch loader functions through DefaultBatchLoaderRegistry.

Recommendations For Spring for GraphQL versions 1.1.0 through 1.1.5, avoid providing a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry to prevent exposure to GraphQL context from different sessions. For Spring for GraphQL versions 1.2.0 through 1.2.2, avoid providing a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry to prevent exposure to GraphQL context from different sessions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2023-34047

GHSA-FRQC-F2H8-FJVF

Affected Products

Spring For Graphql

References · 9

• https://spring.io/security/cve-2023-34047 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34047 · Security Note
• https://osv.dev/vulnerability/GHSA-frqc-f2h8-fjvf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34047 · Vendor Advisory
• https://github.com/spring-projects/spring-graphql · Note
• https://t.me/cibsecurity/70794 · Telegram Post
• https://twitter.com/graphqlweekly/status/1854931984197599706 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1704474485733097685 · Twitter Post
• https://twitter.com/CVEnew/status/1704426973659844723 · Twitter Post