PT-2024-28780 · Unknown · Graphql-Java

🗓️ 30 Jul 2024 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 4 Views

GraphQL Java DoS risk from improper introspection field handling; upgrade to 21.5+.

Reporter	Title	Published	Views	Family All 57
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses IBM WebSphere Application Server Liberty which is vulnerable to CVE-2024-40094.	10 Apr 202510:14	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for July 2025.	7 Aug 202508:58	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty and Java may affect IBM Storage Protect for Virtual Environments (Data Protection for VMware and Data Protection for Hyper-V)	20 Jun 202518:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact	24 Oct 202517:27	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in GraphQL Java affects IBM watsonx Assistant for IBM Cloud Pak for Data	5 Feb 202520:35	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of Service vulnerability in WebSphere Liberty affects IBM SPSS Analytic Server (CVE-2024-40094)	7 Mar 202504:26	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty and Java may affect IBM Storage Protect for Space Management	20 Jun 202518:36	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in graphql-java-20.1.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2024-40094)	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics is affected by vulnerabilities in IBM® Java™ Version 8, IBM® Semeru Runtime and IBM® Websphere Application Server Liberty	27 Mar 202520:25	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty	13 Feb 202514:44	–	ibm

Source	Link
osv	www.osv.dev/vulnerability/CVE-2024-40094
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-40094
osv	www.osv.dev/vulnerability/GHSA-h9mq-f6q5-6c8m
github	www.github.com/graphql-java/graphql-java/commit/469caf6ee600ab6709ad5e8a06f371fe2ef3b8dd
github	www.github.com/graphql-java/graphql-java/releases/tag/v19.11
github	www.github.com/graphql-java/graphql-java/commit/16c159111507ef04d7e1839b2c23281d90c42b2b
github	www.github.com/graphql-java/graphql-java/commit/fc6f304e66cab18b6d06a80c7009524938939a03
github	www.github.com/graphql-java/graphql-java/discussions/3641
github	www.github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a
github	www.github.com/graphql-java/graphql-java/pull/3539

06 Nov 2024 00:00Current

9.1High risk

Vulners AI Score9.1

CVSS 48.7

CVSS 3.15.3

EPSS0.1753

SSVC

Executable Normalized Fields Introspection abuse Twenty one five Twenty nine Nineteen eleven GraphQL Java