CVE-2023-34047
Exposure of data and identity to wrong session in Spring for GraphQL
Résumé
Exposure of data and identity to wrong session in Spring for GraphQL
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web spring.io