CVE-2023-28867 - Vulnerability Details - OpenCVE

In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Graphql-java	Graphql-java
Redhat	Quarkus Service Registry

Configuration 1 [-]

OR	cpe:2.3:a:graphql-java:graphql-java::::::::
	cpe:2.3:a:graphql-java:graphql-java::::::::
	cpe:2.3:a:graphql-java:graphql-java::::::::
	cpe:2.3:a:graphql-java:graphql-java:20.0:::::::*

Package	CPE	Advisory	Released Date
Red Hat build of Quarkus 2.13.8.Final
com.graphql-java/graphql-java:19.4.0.redhat-00001	cpe:/a:redhat:quarkus:2.13::el8	RHSA-2023:3809	2023-06-29T00:00:00Z
RHINT Service Registry 2.4.3 GA
graphql-java	cpe:/a:redhat:service_registry:2.4	RHSA-2023:3815	2023-06-27T00:00:00Z

References

Link	Providers
https://github.com/graphql-java/graphql-java/pull/3112
https://github.com/graphql-java/graphql-java/releases/tag/v17.5
https://github.com/graphql-java/graphql-java/releases/tag/v18.4
https://github.com/graphql-java/graphql-java/releases/tag/v19.4
https://github.com/graphql-java/graphql-java/releases/tag/v20.1
https://nvd.nist.gov/vuln/detail/CVE-2023-28867
https://www.cve.org/CVERecord?id=CVE-2023-28867

History

Wed, 19 Feb 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-03-27T00:00:00.000Z

Updated: 2025-02-19T15:25:51.090Z

Reserved: 2023-03-27T00:00:00.000Z

Link: CVE-2023-28867

Vulnrichment

Updated: 2024-08-02T13:51:38.550Z

NVD

Status : Modified

Published: 2023-03-27T01:15:07.413

Modified: 2024-11-21T07:56:11.547

Link: CVE-2023-28867

Redhat

Severity : Moderate

Publid Date: 2023-03-27T00:00:00Z

Links: CVE-2023-28867 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-28867", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-02-19T15:25:51.090Z", "dateReserved": "2023-03-27T00:00:00.000Z", "datePublished": "2023-03-27T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-03-27T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/graphql-java/graphql-java/pull/3112"}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v17.5"}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v18.4"}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v19.4"}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v20.1"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T13:51:38.550Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/graphql-java/graphql-java/pull/3112", "tags": ["x_transferred"]}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v17.5", "tags": ["x_transferred"]}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v18.4", "tags": ["x_transferred"]}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v19.4", "tags": ["x_transferred"]}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v20.1", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-19T15:25:05.702767Z", "id": "CVE-2023-28867", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-19T15:25:51.090Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/graphql-java/graphql-java/pull/3112", "tags": ["x_transferred"]}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v17.5", "tags": ["x_transferred"]}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v18.4", "tags": ["x_transferred"]}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v19.4", "tags": ["x_transferred"]}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v20.1", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T13:51:38.550Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-28867", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-19T15:25:05.702767Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-19T15:25:45.929Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/graphql-java/graphql-java/pull/3112"}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v17.5"}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v18.4"}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v19.4"}, {"url": "https://github.com/graphql-java/graphql-java/releases/tag/v20.1"}], "descriptions": [{"lang": "en", "value": "In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-03-27T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2023-28867", "state": "PUBLISHED", "dateUpdated": "2025-02-19T15:25:51.090Z", "dateReserved": "2023-03-27T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-03-27T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:graphql-java:graphql-java:*:*:*:*:*:*:*:*", "matchCriteriaId": "69FCAB99-DF08-4B03-9FBC-9621BF9C0820", "versionEndExcluding": "17.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:graphql-java:graphql-java:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A5880A2-BC5A-48B3-9916-91CA7DA48C48", "versionEndExcluding": "18.4", "versionStartIncluding": "18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:graphql-java:graphql-java:*:*:*:*:*:*:*:*", "matchCriteriaId": "45943F35-6801-451B-BC93-0FF9533290BD", "versionEndExcluding": "19.4", "versionStartIncluding": "19.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:graphql-java:graphql-java:20.0:*:*:*:*:*:*:*", "matchCriteriaId": "9A9F6EBC-5C0B-4816-949E-E3AD77343984", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135."}], "id": "CVE-2023-28867", "lastModified": "2024-11-21T07:56:11.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-03-27T01:15:07.413", "references": [{"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/graphql-java/graphql-java/pull/3112"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/graphql-java/graphql-java/releases/tag/v17.5"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/graphql-java/graphql-java/releases/tag/v18.4"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/graphql-java/graphql-java/releases/tag/v19.4"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/graphql-java/graphql-java/releases/tag/v20.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/graphql-java/graphql-java/pull/3112"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/graphql-java/graphql-java/releases/tag/v17.5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/graphql-java/graphql-java/releases/tag/v18.4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/graphql-java/graphql-java/releases/tag/v19.4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/graphql-java/graphql-java/releases/tag/v20.1"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "nvd@nist.gov", "type": "Primary"}]}