CVE-2023-28104: Allocation of Resources Without Limits or Throttling
(updated )
silverstripe/graphql serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with particularly large/complex graphql schemas. Users should upgrade to silverstripe/graphql 4.2.3 or 4.1.2 to remedy the vulnerability.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2023-28104.yaml
- github.com/advisories/GHSA-67g8-c724-8mp3
- github.com/silverstripe/silverstripe-graphql/pull/526
- github.com/silverstripe/silverstripe-graphql/releases/tag/4.1.2
- github.com/silverstripe/silverstripe-graphql/releases/tag/4.2.3
- github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-67g8-c724-8mp3
- nvd.nist.gov/vuln/detail/CVE-2023-28104
- www.silverstripe.org/download/security-releases/CVE-2023-28104
Code Behaviors & Features
Detect and mitigate CVE-2023-28104 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →