« Volver al listado

CVE-2024-40094

Estado: AplazadaMedia (5.3)—

GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Graphql-java — Graphql JavaAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-40094",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-40094",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-30T14:42:03.528958Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-07-30T07:15:01.840",
  "references": [
    {
      "url": "https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/graphql-java/graphql-java/discussions/3641",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/graphql-java/graphql-java/pull/3539",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/graphql-java/graphql-java/releases/tag/v19.11",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/graphql-java/graphql-java/releases/tag/v20.9",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/graphql-java/graphql-java/releases/tag/v21.5",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/graphql-java/graphql-java/discussions/3641",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/graphql-java/graphql-java/pull/3539",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/graphql-java/graphql-java/releases/tag/v19.11",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/graphql-java/graphql-java/releases/tag/v20.9",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/graphql-java/graphql-java/releases/tag/v21.5",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions."
    },
    {
      "lang": "es",
      "value": " GraphQL Java (también conocido como graphql-java) anterior a 21.5 no considera adecuadamente los ExecutableNormalizedFields (ENF) como parte de la prevención de la denegación de servicio mediante consultas de introspección. 20.9 y 19.11 también son versiones fijas."
    }
  ],
  "lastModified": "2026-06-17T07:45:42.450",
  "sourceIdentifier": "cve@mitre.org"
}