IBM WebSphere Application Server: CVE-2023-28867: IBM WebSphere Application Server Liberty is vulnerable to a denial of service due to GraphQL Java (CVE-2023-28867)

IBM WebSphere Application Server: CVE-2023-28867: IBM WebSphere Application Server Liberty is vulnerable to a denial of service due to GraphQL Java (CVE-2023-28867)

Severity

8

CVSS

(AV:N/AC:L/Au:N/C:N/I:N/A:C)

Published

03/27/2023

Created

06/01/2023

Added

06/01/2023

Modified

01/28/2025

Description

In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.

Solution(s)

• ibm-was-install-8-5-ph54373-liberty
• ibm-was-upgrade-8-5-23-0-0-6-liberty

References

• https://attackerkb.com/topics/cve-2023-28867
• CVE - 2023-28867