Red Hat OpenShift Container Platform GraphQL Introspection Information Disclosure (CVE-2024-50312)

Key Information 1. Vulnerability ID: - CVE-2024-50312 2. Release Date: - October 17, 2024 3. Last Updated: - October 22, 2024 4. Severity: - Medium 5. Description: - A vulnerability exists in GraphQL due to improper access control of GraphQL introspection queries. Unauthorized users can retrieve a comprehensive list of available queries and mutations. Exposure to this vulnerability increases the attack surface, as it can facilitate the discovery of specific vulnerabilities or flaws in the application's GraphQL implementation. 6. Mitigation: - GraphQL introspection should be disabled. Users should not have the ability to view all available queries, mutations, and data types. 7. Affected Packages and Red Hat Security Patches: - Red Hat OpenShift Container Platform 4 - openShift4/ose-console - Impact Status: Affected 8. CVSS Score: - CVSS v3 Base Score: 5.3 - CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 9. Acknowledgments: - Thank you to Awomir Zakrzewski, Maksymilian Kubiak, and Paweł Zdunek for reporting this issue. 10. FAQs: - Why does Red Hat’s CVSS v3 score or impact differ from other vendors? - My product is listed as “under investigation” or “affected”—when will Red Hat release a fix for this vulnerability? - If my product is listed as “unfixable,” what should I do? - If my product is listed as “fix deferred,” what should I do? - What are mitigations? - I have a Red Hat product, but it’s not listed above—am I affected? - Why is my security scanner reporting that my product is affected by this vulnerability, even though my product version is patched or unaffected? 11. Disclaimer: - This page is auto-generated and has not been checked for errors or omissions. - For clarifications or corrections, please contact the Red Hat Product Security Team. 12. Copyright: - CVE description copyright © 2021

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat OpenShift Container Platform GraphQL Introspection Information Disclosure (CVE-2024-50312)

More from this source