CVE-2024-50312
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.16 | v4.16.0-202501080105.p0.g6fe3e8b.assembly.stream.el9 < * | unaffected |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | v4.17.0-202501080135.p0.gedbd12e.assembly.stream.el9 < * | unaffected |
Weaknesses
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Workarounds
GraphQL Introspection should be disabled. Users should not have the ability to view all available queries, mutations, and data types.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: partial
References
- https://access.redhat.com/errata/RHSA-2025:0115
- https://access.redhat.com/errata/RHSA-2025:0140
- https://access.redhat.com/security/cve/CVE-2024-50312
- https://bugzilla.redhat.com/show_bug.cgi?id=2319378
- https://github.com/openshift/console/pull/14409/files
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.