| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.graphql:spring-graphql | ≥ 1.1.0, < 1.1.6≥ 1.2.0, < 1.2.3 | 1.1.61.2.3 |
| spring for graphql | ≥ 1.1.0, ≤ 1.1.5≥ 1.2.0, ≤ 1.2.2 |
A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free