CVE-2024-50312

Graphql: information disclosure via graphql introspection in openshift

View on CVE.org
Published Oct 22, 2024 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.

Remediation

Vendor Workaround

GraphQL Introspection should be disabled. Users should not have the ability to view all available queries, mutations, and data types.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-45216 A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.18::el9
References
Type Values Removed Values Added
Metrics cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.16::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4 cpe:/a:redhat:openshift:4.17::el9
References
Type Values Removed Values Added
First Time appeared Redhat openshift Container Platform
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
Vendors & Products Redhat openshift Container Platform
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description No description is available for this CVE. A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.
Title GraphQL: Information Disclosure via GraphQL Introspection in OpenShift Graphql: information disclosure via graphql introspection in openshift
First Time appeared Redhat
Redhat openshift
CPEs cpe:/a:redhat:openshift:4
Vendors & Products Redhat
Redhat openshift
References
Type Values Removed Values Added
Description No description is available for this CVE.
Title GraphQL: Information Disclosure via GraphQL Introspection in OpenShift
Weaknesses CWE-200
References
Metrics threat_severity

None

 cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

threat_severity

Moderate
Earlier changes (3)
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 11, 2026, 3:22 PM
Reserved
Oct 22, 2024, 7:15 AM

View source JSON

Updated
Oct 22, 2024, 5:38 PM

JSON

Status
Modified
Published
Oct 22, 2024, 2:15 PM
Modified
Aug 11, 2026, 4:17 PM

View source JSON

Severity
Moderate
Public date
Oct 17, 2024, 1:17 PM

View source Bugzilla JSON

No data.