Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors.
References
| Link | Resource |
|---|---|
| https://github.com/ohler55/agoo/issues/109 | Exploit Issue Tracking Third Party Advisory |
| https://spec.graphql.org/October2021/#sec-Fragment-spreads-must-not-form-cycles | Third Party Advisory |
| https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md | Third Party Advisory |
Configurations
History
07 Nov 2023, 03:47
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors. |
Information
Published : 2022-05-04 23:15
Updated : 2024-08-22 15:35
NVD link : CVE-2022-30288
Mitre link : CVE-2022-30288
JSON object : View
Products Affected
ohler
- agoo
CWE