CVE-2022-30288
High
Description
Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors.
SeverityHigh
CVSS7.5
Exploit probability—
ProductOhler Agoo
PublishedMay 4, 2022
First seenMay 4, 2022
How to fix
Update
- ohler agoo2.14.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ohler agoo | v < 2.14.3 | 2.14.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.