CVE-2023-28104highCWE-770

CVE-2023-28104: falha de alta gravidade em silverstripe-graphql

silverstripe/graphql Denial of Service vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar silverstripe-graphql+ Monitorar silverstripe/graphql

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 1.1%
`silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with particularly large/complex graphql schemas. Users should upgrade to `silverstripe/graphql` 4.2.3 or 4.1.2 to remedy the vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
silverstripe · silverstripe-graphql
CVEs relacionadas — silverstripe-graphql

No mesmo produto, das mais perigosas para as menos.

CVE-2023-40180HIGHDenial of service vulnerability in silverstripe-graphql via recursive queriesEPSS 1.1%CVE-2023-44401MEDIUMSilverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM dataEPSS 0.4%