=====================================================================

                              CERT-Renater

                    Note d'Information No. 2023/VULN335

_____________________________________________________________________

DATE                : 20/09/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Spring for GraphQL versions prior
                                    to 1.1.6, 1.2.3.

=====================================================================
https://spring.io/security/cve-2023-34047/
_____________________________________________________________________


CVE-2023-34047: Exposure of data and identity to wrong session in
Spring for GraphQL

LOW | SEPTEMBER 19, 2023 | CVE-2023-34047
Description

A batch loader function in Spring for GraphQL versions
1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL
context with values, including security context values, from
a different session. An application is vulnerable if it
provides a DataLoaderOptions instance when registering batch
loader functions through DefaultBatchLoaderRegistry.
Affected Spring Products and Versions

     Spring for GraphQL 1.1.0 - 1.1.5
     Spring for GraphQL 1.2.0 - 1.2.2

Older versions are not affected.


Mitigation

Users of affected versions should upgrade to the following
versions:

     1.1.x should upgrade to 1.1.6
     1.2.x should upgrade to 1.2.3


Credit

The issue was reported by Jack Rowland.


References

 
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N&version=3.1

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================