Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2023-34047

Exposure of data and identity to wrong session in Spring for GraphQL

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring for GraphQL

Default version status: unaffected

  • 1.1.0 to < 1.1.6affected
  • 1.2.0 to < 1.2.3affected

References