CVE-2022-30288
Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on t...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors.
Références
- advisory github.com
- advisory nvd.nist.gov
- report github.com
- web github.com
- web spec.graphql.org