CVE-2024-50312

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50312
A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2025:0115
https://access.redhat.com/errata/RHSA-2025:0140
https://access.redhat.com/security/cve/CVE-2024-50312 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2319378 Issue Tracking
https://github.com/openshift/console/pull/14409/files Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
History

15 Jan 2025, 02:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:0140 -

14 Jan 2025, 13:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:0115 -

30 Oct 2024, 18:35

Type Values Removed Values Added
First Time Redhat openshift Container Platform
Redhat
References () https://access.redhat.com/security/cve/CVE-2024-50312 - () https://access.redhat.com/security/cve/CVE-2024-50312 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2319378 - () https://bugzilla.redhat.com/show_bug.cgi?id=2319378 - Issue Tracking
References () https://github.com/openshift/console/pull/14409/files - () https://github.com/openshift/console/pull/14409/files - Patch
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*

23 Oct 2024, 15:12

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en GraphQL debido a controles de acceso inadecuados en la consulta de introspección de GraphQL. Este fallo permite que usuarios no autorizados recuperen una lista completa de consultas y mutaciones disponibles. La exposición a este fallo aumenta la superficie de ataque, ya que puede facilitar el descubrimiento de fallos o errores específicos de la implementación de GraphQL de la aplicación.

22 Oct 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-22 14:15

Updated : 2025-01-15 02:15

NVD link : CVE-2024-50312

Mitre link : CVE-2024-50312

CVE.ORG link : CVE-2024-50312

JSON object : View

Products Affected

redhat

  • openshift_container_platform
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo