Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-28104

Date: March 16, 2023

"silverstripe/graphql" serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with particularly large/complex graphql schemas. Users should upgrade to "silverstripe/graphql" 4.2.3 or 4.1.2 to remedy the vulnerability.

Language: PHP

Severity Score

Related Resources (9)

https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-67g8-c724-8mp3
https://nvd.nist.gov/vuln/detail/CVE-2023-28104
https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2023-28104.yaml
https://github.com/silverstripe/silverstripe-graphql/pull/526
https://github.com/silverstripe/silverstripe-graphql/releases/tag/4.2.3
https://www.silverstripe.org/download/security-releases/CVE-2023-28104
https://github.com/silverstripe/silverstripe-graphql/releases/tag/4.1.2
https://github.com/silverstripe/silverstripe-graphql
https://www.mend.io/vulnerability-database/CVE-2023-28104

Severity Score

Weakness Type (CWE)

Allocation of Resources Without Limits or Throttling

CWE-770

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us