| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.graphql:spring-graphql | ≥ 1.3.0, ≤ 1.3.8≥ 1.4.0, < 1.4.6≥ 2.0.0, < 2.0.4 | 1.4.62.0.4 |
| spring for graphql | ≥ 1.3.0, < 1.3.9≥ 1.4.0, < 1.4.5.1≥ 2.0.0, < 2.0.3.1 | 1.3.91.4.5.12.0.3.1 |
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free