CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-44401 – Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data
https://notcve.org/view.php?id=CVE-2023-44401
The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, `canView` permission checks are bypassed for ORM data in paginated GraphQL query results where the total number of records is greater than the number of records per page. Note that this also affects GraphQL queries which have a limit applied, even if the query isn’t paginated per se. This has been fixed in versions 4.3.7 and 5.1.3 by ensuring no new records are pulled in from the database after performing `canView` permission checks for each page of results. This may result in some pages in the query results having less than the maximum number of records per page even when there are more pages of results. • https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-jgph-w8rh-xf5p https://www.silverstripe.org/download/security-releases/CVE-2023-44401 • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-40180 – Denial of service vulnerability in silverstripe-graphql via recursive queries
https://notcve.org/view.php?id=CVE-2023-40180
silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If your Silverstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attack. If your site is hosted behind a content delivery network (CDN), such as Imperva or CloudFlare, this may further mitigate the risk. • https://docs.silverstripe.org/en/developer_guides/graphql/security_and_best_practices/recursive_or_complex_queries https://github.com/silverstripe/silverstripe-graphql/commit/f6d5976ec4608e51184b0db1ee5b9e9a99d2501c https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-v23w-pppm-jh66 https://github.com/silverstripe/silverstripe-graphql/tree/3.8#recursive-or-complex-queries https://www.silverstripe.org/download/security-releases/CVE-2023-40180 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28104 – silverstripe/graphql Denial of Service vulnerability
https://notcve.org/view.php?id=CVE-2023-28104
`silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with particularly large/complex graphql schemas. Users should upgrade to `silverstripe/graphql` 4.2.3 or 4.1.2 to remedy the vulnerability. • https://github.com/silverstripe/silverstripe-graphql/pull/526 https://github.com/silverstripe/silverstripe-graphql/releases/tag/4.1.2 https://github.com/silverstripe/silverstripe-graphql/releases/tag/4.2.3 https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-67g8-c724-8mp3 • CWE-770: Allocation of Resources Without Limits or Throttling •