{"id":"GHSA-frqc-f2h8-fjvf","summary":"Spring for GraphQL may be exposed to GraphQL context with values from a different session","details":"A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.\n","aliases":["CVE-2023-34047"],"modified":"2024-12-04T05:38:00.925084Z","published":"2023-09-20T12:30:22Z","database_specific":{"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2023-09-21T16:59:16Z","nvd_published_at":"2023-09-20T10:15:14Z","cwe_ids":[]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34047"},{"type":"PACKAGE","url":"https://github.com/spring-projects/spring-graphql"},{"type":"WEB","url":"https://spring.io/security/cve-2023-34047"}],"affected":[{"package":{"name":"org.springframework.graphql:spring-graphql","ecosystem":"Maven","purl":"pkg:maven/org.springframework.graphql/spring-graphql"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.6"}]}],"versions":["1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-frqc-f2h8-fjvf/GHSA-frqc-f2h8-fjvf.json"}},{"package":{"name":"org.springframework.graphql:spring-graphql","ecosystem":"Maven","purl":"pkg:maven/org.springframework.graphql/spring-graphql"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.3"}]}],"versions":["1.2.0","1.2.1","1.2.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-frqc-f2h8-fjvf/GHSA-frqc-f2h8-fjvf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"}]}