Skip to content
Fencer Vulns
medium 5.3

CVE-2024-50312 json

Graphql: information disclosure via graphql introspection in openshift

published 2024-10-22 2 y ago modified 2026-08-11 2 mo ago also GO-2024-3211 , EUVD-2024-45216

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.16 v4.16.0-202501080105.p0.g6fe3e8b.assembly.stream.el9
  • Red Hat Red Hat OpenShift Container Platform 4.17 v4.17.0-202501080135.p0.gedbd12e.assembly.stream.el9
  • Red Hat Red Hat OpenShift Container Platform 4.18 v4.18.0-202501230001.p0.g0e11616.assembly.stream.el9, v4.18.0-202501230001.p0.g3f6d1d8.assembly.stream.el9, v4.18.0-202501230001.p0.g07daee4.assembly.stream.el9, v4.18.0-202501230001.p0.g11ced00.assembly.stream.el9, v4.18.0-202501230001.p0.g24a6532.assembly.stream.el9, v4.18.0-202501230001.p0.g088dcaf.assembly.stream.el9, v4.18.0-202501230001.p0.g962ccca.assembly.stream.el9, v4.18.0-202501230001.p0.g3193a75.assembly.stream.el9, v4.18.0-202501230001.p0.g5348c85.assembly.stream.el9, v4.18.0-202501230001.p0.g7149f2d.assembly.stream.el9, v4.18.0-202501230001.p0.gba2234b.assembly.stream.el9, v4.18.0-202501230001.p0.gd4fb1b6.assembly.stream.el9, v4.18.0-202501230001.p0.gf648c78.assembly.stream.el9, v4.18.0-202502040032.p0.g5348c85.assembly.stream.el9, v4.18.0-202502040032.p0.ge5a4005.assembly.stream.el9, v4.18.0-202502041302.p0.g1ad8f2e.assembly.stream.el9, v4.18.0-202502041302.p0.g51a74ac.assembly.stream.el9, v4.18.0-202502100301.p0.g2e139ed.assembly.stream.el9, v4.18.0-202502100934.p0.gc00c7c9.assembly.stream.el9, v4.18.0-202502111035.p0.gf76635f.assembly.stream.el9
  • govulncheck-vulndb SLE Module for Package Hub 15 SP6, SLE Module for Package Hub 15 SP5, openSUSE Leap 15.6 +1 more 0.0.20241030T212825-150000.1.9.1

suse advisories SUSE-SU-2024:3911-1

  • govulncheck-vulndb Package Hub 12 0.0.20241104T154416-5.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20241030T212825-1.1

opensuse advisories openSUSE-SU-2024:0350-1openSUSE-SU-2024:14447-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-50312 updated cvss 5.3

GraphQL: Information Disclosure via GraphQL Introspection in OpenShift

  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-console-rhel9 v4.16.0-202501080105.p0.g6fe3e8b.assembly.stream.el9
    fixed: vendor fix “GraphQL Introspection should be disabled. Users should not have the ability to view all available queries, mutations, and data types.” RHSA-2025:0140
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-console-rhel9 v4.17.0-202501080135.p0.gedbd12e.assembly.stream.el9
    fixed: vendor fix “GraphQL Introspection should be disabled. Users should not have the ability to view all available queries, mutations, and data types.” RHSA-2025:0115
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202502100215-0, openshift4/frr-rhel9 v4.18.0-202502041302.p0.g1ad8f2e.assembly.stream.el9, openshift4/ose-cli-rhel9 v4.18.0-202502040032.p0.ga50d4c0.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.18.0-202502051032.p0.gacb9630.assembly.stream.el9, openshift4/ose-etcd-rhel9 v4.18.0-202501230001.p0.g914783c.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.18.0-202502110432.p0.g0c7bed9.assembly.stream.el9, +184 more
    fixed: vendor fix “GraphQL Introspection should be disabled. Users should not have the ability to view all available queries, mutations, and data types.” RHSA-2024:6122
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202501030250-0, openshift4/ose-tests-rhel9 v4.16.0-202501080105.p0.gc740dbd.assembly.stream.el9, openshift4/ose-tools-rhel9 v4.16.0-202501080105.p0.gcf533b5.assembly.stream.el9, openshift4/network-tools-rhel9 v4.16.0-202501080105.p0.g39eca10.assembly.stream.el9, openshift4/driver-toolkit-rhel9 v4.16.0-202501081237.p0.g1d5732f.assembly.stream.el9, openshift4/ose-hypershift-rhel9 v4.16.0-202501072135.p0.ge3c671d.assembly.stream.el9, +13 more Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202501071621-0, openshift4/frr-rhel9 v4.17.0-202501021936.p0.g377d02f.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.17.0-202501080135.p0.g3019778.assembly.stream.el9, openshift4/ose-tools-rhel9 v4.17.0-202501080135.p0.gf4525b8.assembly.stream.el9, openshift4/network-tools-rhel9 v4.17.0-202501080135.p0.g8e170b4.assembly.stream.el9, openshift4/ose-hypershift-rhel9 v4.17.0-202501061407.p0.g42c519f.assembly.stream.el9, +13 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA ADP 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/openshift/console
all versions
 no fix listed

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.