CVE-2023-34047: Spring for GraphQL may be exposed to GraphQL context with values from a different session

September 20, 2023 (updated October 18, 2023)

A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.

References

github.com/advisories/GHSA-frqc-f2h8-fjvf
nvd.nist.gov/vuln/detail/CVE-2023-34047
spring.io/security/cve-2023-34047

Code Behaviors & Features

Detect and mitigate CVE-2023-34047 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →