CVE-2024-50312: Graphql: information disclosure via graphql introspection in openshift
A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.
Other sources
In GraphQL, information leak vulnerability has been observed while interacting with GraphQL API. Users or unauthorized actors can view information about all available queries and mutations in server's response. This type of information can provide an attacker with numerous opportunities to identify vulnerabilities and processing errors
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50312?
CVE-2024-50312 is a vulnerability with a high severity level due to improper access controls on the GraphQL introspection query.
How do I fix CVE-2024-50312?
To fix CVE-2024-50312, apply the latest security patches provided by Red Hat for OpenShift Container Platform 4.0.
Who is affected by CVE-2024-50312?
CVE-2024-50312 affects users of Red Hat OpenShift Container Platform version 4.0.
What impact does CVE-2024-50312 have on systems?
CVE-2024-50312 allows unauthorized users to retrieve sensitive information about the available queries and mutations, increasing the attack surface.
Is there a workaround for CVE-2024-50312?
Currently, no official workaround has been suggested for CVE-2024-50312; updating to the latest version is the best course of action.