CVE-2023-28104

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

`silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpoint. This mostly affects websites with particularly large/complex graphql schemas. Users should upgrade to `silverstripe/graphql` 4.2.3 or 4.1.2 to remedy the vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
silverstripe	silverstripe-graphql	= 4.1.1; = 4.2.2

References

https://github.com/silverstripe/silverstripe-graphql/pull/526Patch
https://github.com/silverstripe/silverstripe-graphql/releases/tag/4.1.2Patch, Release Notes
https://github.com/silverstripe/silverstripe-graphql/releases/tag/4.2.3Patch, Release Notes
https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-67g8-c724-8mp3Vendor Advisory
https://github.com/silverstripe/silverstripe-graphql/pull/526Patch
https://github.com/silverstripe/silverstripe-graphql/releases/tag/4.1.2Patch, Release Notes
https://github.com/silverstripe/silverstripe-graphql/releases/tag/4.2.3Patch, Release Notes
https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-67g8-c724-8mp3Vendor Advisory

Timeline

Published: Mar 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-281058.8go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip fi CVE-2023-281064.8Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to sen CVE-2023-281074.9Discourse is an open-source discussion platform. Prior to version 3.0.2 of the `stable` branch and version 3.1.0.beta3 of the `beta` and `te CVE-2023-281087.8Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model.CVE-2023-281096.5Play With Docker is a browser-based Docker playground. Versions 0.0.2 and prior are vulnerable to domain hijacking. Because CORS configurati CVE-2023-28114.8The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow high privilege users s CVE-2023-281109.9Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/CVE-2023-281117.5Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, attackers are able CVE-2023-281128.1Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, some user provided CVE-2023-281135.9russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key valida CVE-2023-281144.1`cilium-cli` is the command line interface to install, manage, and troubleshoot Kubernetes clusters running Cilium. Prior to version 0.13.2,CVE-2023-281159.8Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerab