Spring for GraphQL vulnerabilities
6 known vulnerabilities in Spring for GraphQL from Spring. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Spring for GraphQL: Allocation of Resources Without Limits or Throttling
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memor
- 7.4 High severity
Spring for GraphQL: Exposure of Sensitive Information to an Unauthorized Actor
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2
- 8.1 High severity
Spring for GraphQL: Download of Code Without Integrity Check
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Sp
- 7.5 High severity
Spring for GraphQL: Improper Access Control
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met
- 8.1 High severity
Spring for GraphQL: Origin Validation Error
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operation
- 9.8 Critical severity
Spring for GraphQL: Deserialization of Untrusted Data
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) f