CVE-2023-28104

"silverstripe/graphql" serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with...

CVE-2023-28104: Allocation of Resources Without Limits or Throttling

silverstripe/graphql serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with...

CVE-2021-28661

Default SilverStripe GraphQL Server aka silverstripe/graphql 3.x through 3.4.1 permission checker not inherited by query subclass...

CVE-2021-28661

Default SilverStripe GraphQL Server aka silverstripe/graphql 3.x through 3.4.1 permission checker not inherited by query subclass...

CVE-2021-28661

Default SilverStripe GraphQL Server aka silverstripe/graphql 3.x through 3.4.1 permission checker not inherited by query subclass...

CVE-2021-28661: Incorrect Authorization

Default SilverStripe GraphQL Server aka silverstripe/graphql 3.x through 3.4.1 permission checker not inherited by query subclass...

CVE-2020-6165

SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The automatic permission-checking mechanism in the silverstripe/graphql module does not provide complete protection against lists that are limited...

CVE-2020-6165: Incorrect Default Permissions

SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The automatic permission-checking mechanism in the silverstripe/graphql module does not provide complete protection against lists that are limited...

PT-2020-9321

Name of the Vulnerable Software and Affected Versions: SilverStripe versions prior to 4.3.4 SilverStripe/GraphQL versions prior to 2.0.5 SilverStripe/GraphQL versions prior to 3.1.2 Description: The previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations...

Cross-Site Request Forgery (CSRF)

silverstripe/graphql is vulnerable to cross-site request forgery CSRF. The code change that implements CSRF protection on GraphQL mutation queries does not adequately verify the authenticity of requests on GraphQL endpoints. A GraphQL query formed with a fragment portion before the mutation would...