CVE-2023-34047

2023-09-2010:15:14

vmware

web.nvd.nist.gov

2465

cve-2023-34047

spring

graphql

batch loader

security context

dataloaderoptions

vulnerability

nvd

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

30.8%

JSON

A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.

Affected configurations

Nvd

Node

vmwarespring_for_graphqlRange1.1.0–1.1.5

vmwarespring_for_graphqlRange1.2.0–1.2.2

VendorProductVersionCPE
vmwarespring_for_graphql*cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vmware	spring_for_graphql	*	cpe:2.3:a:vmware:spring_for_graphql::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "Linux",
      "iOS",
      "Android",
      "x86",
      "ARM",
      "64 bit",
      "MacOS",
      "32 bit"
    ],
    "product": "Spring for GraphQL",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "1.1.6",
        "status": "affected",
        "version": "1.1.0",
        "versionType": "1.1.6"
      },
      {
        "lessThan": "1.2.3",
        "status": "affected",
        "version": "1.2.0",
        "versionType": "1.2.3"
      }
    ]
  }
]