| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.graphql:spring-graphql | ≥ 1.0.0, ≤ 1.0.6≥ 1.3.0, ≤ 1.3.8≥ 1.4.0, < 1.4.6≥ 2.0.0, < 2.0.4 | 1.4.62.0.4 |
| spring for graphql | ≥ 1.0.0, < 1.0.7≥ 1.3.0, < 1.3.9≥ 1.4.0, < 1.4.5.1≥ 2.0.0, < 2.0.3.1 | 1.0.71.3.91.4.5.12.0.3.1 |
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free