CVE-2023-45812
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-45812 is a Denial-of-Service (DoS) vulnerability affecting the Apollo Router, a configurable graph router written in Rust. The vulnerability occurs when a multi-part response is sent to the Router, causing it to panic and terminate. This vulnerability specifically affects users who have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also support either `@defer` or Subscriptions. The Apollo Router version 1.33.0 includes a fix for this vulnerability introduced in PR #4014. Users are advised to upgrade to this version to remediate the issue. In case upgrading is not feasible, users should avoid using the coprocessor supergraph response or disable defer and subscriptions support while continuing to use the coprocessor supergraph response. This vulnerability has a high severity rating with an exploitability score of 3.9 out of 10 and poses a potential danger of network-based attacks leading to availability impact on affected systems.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions