{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-34047", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2023-05-25T17:21:56.202Z", "datePublished": "2023-09-20T09:09:12.648Z", "dateUpdated": "2023-09-20T09:09:12.648Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "Linux", "iOS", "Android", "x86", "ARM", "64 bit", "MacOS", "32 bit"], "product": "Spring for GraphQL", "vendor": "Spring", "versions": [{"lessThan": "1.1.6", "status": "affected", "version": "1.1.0", "versionType": "1.1.6"}, {"lessThan": "1.2.3", "status": "affected", "version": "1.2.0", "versionType": "1.2.3"}]}], "datePublic": "2023-09-19T09:02:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a </span><code>DataLoaderOptions</code><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;instance when registering batch loader functions through </span><code>DefaultBatchLoaderRegistry</code><span style=\"background-color: rgb(255, 255, 255);\">.</span><br>"}], "value": "A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions\u00a0instance when registering batch loader functions through DefaultBatchLoaderRegistry.\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2023-09-20T09:09:12.648Z"}, "references": [{"url": "https://spring.io/security/cve-2023-34047"}], "source": {"discovery": "UNKNOWN"}, "title": "Exposure of data and identity to wrong session in Spring for GraphQL", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*", "matchCriteriaId": "49D2097C-3900-4B29-9308-9F9649B2EF1C", "versionEndIncluding": "1.1.5", "versionStartIncluding": "1.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*", "matchCriteriaId": "6FE36EDA-2CA3-4390-BF83-E532BAEA7807", "versionEndIncluding": "1.2.2", "versionStartIncluding": "1.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions\u00a0instance when registering batch loader functions through DefaultBatchLoaderRegistry.\n"}, {"lang": "es", "value": "Una funci\u00f3n de cargador por lotes en Spring para las versiones GraphQL 1.1.0 - 1.1.5 y 1.2.0 - 1.2.2 puede estar expuesta al contexto GraphQL con valores, incluidos valores de contexto de seguridad, de una sesi\u00f3n diferente. Una aplicaci\u00f3n es vulnerable si proporciona una instancia de DataLoaderOptions al registrar funciones del cargador por lotes a trav\u00e9s de DefaultBatchLoaderRegistry."}], "id": "CVE-2023-34047", "lastModified": "2023-10-18T18:04:30.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "security@vmware.com", "type": "Secondary"}]}, "published": "2023-09-20T10:15:14.247", "references": [{"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2023-34047"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}