CVE-2024-50312: Graphql: information disclosure via graphql introspection in openshift
First published: Thu Oct 17 2024(Updated: )
A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat OpenShift Container Platform | =4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-50312?
CVE-2024-50312 is a vulnerability with a high severity level due to improper access controls on the GraphQL introspection query.
How do I fix CVE-2024-50312?
To fix CVE-2024-50312, apply the latest security patches provided by Red Hat for OpenShift Container Platform 4.0.
Who is affected by CVE-2024-50312?
CVE-2024-50312 affects users of Red Hat OpenShift Container Platform version 4.0.
What impact does CVE-2024-50312 have on systems?
CVE-2024-50312 allows unauthorized users to retrieve sensitive information about the available queries and mutations, increasing the attack surface.
Is there a workaround for CVE-2024-50312?
Currently, no official workaround has been suggested for CVE-2024-50312; updating to the latest version is the best course of action.
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- agent/remedy
- agent/severity
- agent/references
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-50312
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/redhat
- canonical/red hat openshift container platform
- version/red hat openshift container platform/4.0