CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NCVE-2023-34047
Medium (4.3) in vmware spring for graphql. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in org.springframework.graphql:spring-graphql 1.1.6, 1.2.3.
A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vmware:spring_for_graphql
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-frqc-f2h8-fjvf | Maven | org.springframework.graphql:spring-graphql | >=1.1.0 <1.1.6 | 1.1.6 |
| GHSA-frqc-f2h8-fjvf | Maven | org.springframework.graphql:spring-graphql | >=1.2.0 <1.2.3 | 1.2.3 |