CVE-2024-50312 OpenShift GraphQL Information Disclosure via Introspection

Bug 2319378 (CVE-2024-50312) - CVE-2024-50312 GraphQL: Information Disclosure via GraphQL Introspection in OpenShift Key Information: CVE ID: CVE-2024-50312 Report Date: 2024-10-17 14:28 UTC Reporter: OSIDB Bzimport Fix Date: 2024-10-22 12:42 UTC Product: Security Response Component: vulnerability Version: unspecified Operating System: Linux Priority: medium Severity: medium Description: - In GraphQL, an information disclosure vulnerability has been observed during interaction with the GraphQL API. - Users or unauthorized attackers can view information about all available queries and mutations. - This information can provide attackers with opportunities to identify vulnerabilities and processing errors in the application. Additional Information: Keywords: Security Status: NEW Target Milestone: --- Assigned To: Product Security DevOps Team Documentation Type: If docs needed, set a value Documentation Text: A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation. Attachments: Attachment Description: - In GraphQL, information leak vulnerability has been observed while interacting with GraphQL API. - Users or unauthorized actors can view information about all available queries and mutations in server's response. This type of information can provide an attacker with numerous opportunities to identify vulnerabilities and processing errors. Note: Login required to comment or modify this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-50312 OpenShift GraphQL Information Disclosure via Introspection