Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.3.0, < 1.3.9CPE matchmatch criteria | cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:* | ||
>= 1.4.0, < 1.4.5.1CPE matchmatch criteria | cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:* | ||
>= 2.0.0, < 2.0.3.1CPE matchmatch criteria | cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.