CVE-2023-40180

Katalog CVE

CVSS 7.5 · High EPSS 0,90%

Kerentanan Uncontrolled Resource Consumption pada silverstripe graphql. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If your Silverstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attack. If your site is hosted behind a content delivery network (CDN), such as Imperva or CloudFlare, this may further mitigate the risk. This issue has been addressed in versions 3.8.2, 4.1.3, 4.2.5, 4.3.4, and 5.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

16 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,90% peluang dieksploitasi; lebih tinggi dari 58,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.silverstripe.org/download/security-releases/CVE-2023-40180 advisory vendor
• https://github.com/silverstripe/silverstripe-graphql/commit/f6d5976ec4608e51184b0db1ee5b9e9a99d2501c patch
• https://docs.silverstripe.org/en/developer_guides/graphql/security_and_best_practices/recursive_or_complex_que... mitigasi
• https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-v23w-pppm-jh66 advisory pihak ketiga
• https://github.com/silverstripe/silverstripe-graphql/tree/3.8#recursive-or-complex-queries advisory pihak ketiga