CVE-2022-30288

Katalog CVE

CVSS 7.5 · High EPSS 1,6%

Kerentanan pada ohler agoo. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors.

Rincian

Terbit di NVD

4 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md advisory pihak ketiga
• https://github.com/ohler55/agoo/issues/109 exploit · issue tracking · advisory pihak ketiga
• https://spec.graphql.org/October2021/#sec-Fragment-spreads-must-not-form-cycles advisory pihak ketiga