p PatchFirst

CVE-2023-40180

CVE-2023-40180 · Denial of service vulnerability in silverstripe-graphql via recursive queries

This page contains facts from public vulnerability sources. Check the original advisory before updating.

silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If your Silverstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attack. If your site is hosted behind a content delivery network (CDN), such as Imperva or CloudFlare, this may further mitigate the risk. This issue has been addressed in versions 3.8.2, 4.1.3, 4.2.5, 4.3.4, and 5.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 7.5 · High · EPSS 1.1% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • silverstripe-graphql

    Versions
    • >= 3.0.0, < 3.8.2: Affected
    • >= 4.0.0, < 4.1.3: Affected
    • >= 4.2.0, < 4.2.5: Affected
    • >= 4.3.0, < 4.3.4: Affected
    • >= 5.0.0, < 5.0.3: Affected

    No fix published

  • silverstripe/graphql Packagist

    Versions
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.1.0
    • 3.1.0-rc1
    • 3.1.1
    • 3.1.2
    • 3.1.3
    • 3.1.4
    • 3.1.5
    • 3.2.0
    • 3.2.0-alpha1
    • 3.2.0-rc1
    • 3.2.0-rc2
    • 3.2.1
    • 3.2.2
    • 3.2.3
    • 3.2.4
    • 3.3.0
    • 3.3.0-beta1
    • 3.3.0-rc1
    • 3.4.0
    • 3.4.0-beta1
    • 3.4.0-rc1
    • 3.4.1
    • 3.5.0
    • 3.5.0-beta1
    • 3.5.0-rc1
    • 3.5.1
    • 3.5.2
    • 3.6.0
    • 3.6.0-alpha1
    • 3.6.0-alpha2
    • 3.6.0-beta1
    • 3.6.0-rc1
    • 3.7.0
    • 3.7.1
    • 3.7.2
    • 3.8.0
    • 3.8.1
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.8.2

    Update to 3.8.2

  • silverstripe/graphql Packagist

    Versions
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 4.1.0-beta1
    • 4.1.0-rc1
    • 4.1.1
    • 4.1.2
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, < 4.1.3

    Update to 4.1.3

  • silverstripe/graphql Packagist

    Versions
    • 4.2.0
    • 4.2.1
    • 4.2.2
    • 4.2.3
    • 4.2.4
    Affected ranges
    • ECOSYSTEM: ≥ 4.2.0, < 4.2.5

    Update to 4.2.5

  • silverstripe/graphql Packagist

    Versions
    • 4.3.0
    • 4.3.1
    • 4.3.2
    • 4.3.3
    Affected ranges
    • ECOSYSTEM: ≥ 4.3.0, < 4.3.4

    Update to 4.3.4

  • silverstripe/graphql Packagist

    Versions
    • 5.0.0
    • 5.0.1
    • 5.0.2
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 5.0.3

    Update to 5.0.3

Original sources

Check your server →