CVE-2024-50312CWE-200information-disclosure

CVE-2024-50312

Medium · published October 22, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00559 · 45.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-10-22T18:15Z
Affected products (1)
ProductVersionsFixed in
redhat/openshift_container_platformall versions—
References (6)
https://access.redhat.com/errata/RHSA-2025:0115 · [email protected]https://access.redhat.com/errata/RHSA-2025:0140 · [email protected]https://access.redhat.com/security/cve/CVE-2024-50312 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2319378 · [email protected]https://github.com/openshift/console/pull/14409/files · [email protected]https://access.redhat.com/errata/RHSA-2024:6122 · [email protected]
EPSS history
Timeline
  • 22 OCT 13:24Z
    Graphql: information disclosure via graphql introspection in openshift
    cvelistv5