Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

silverstripe/graphql

7 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 high, 1 medium
Registry
Packagist

Advisories 7

  • CVE-2023-44401Medium 5.3

    Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data

    Affected: from 4.0.0, fixed in 4.3.7; from 5.0.0, fixed in 5.1.3.

  • Denial of service vulnerability in silverstripe-graphql via recursive queries

    Affected: from 3.0.0, fixed in 3.8.2; from 4.0.0, fixed in 4.1.3; from 4.2.0, fixed in 4.2.5; from 4.3.0, fixed in 4.3.4; from 5.0.0, fixed in 5.0.3.

  • silverstripe/graphql Denial of Service vulnerability

    Affected: from 4.1.1, fixed in 4.1.2; from 4.2.2, fixed in 4.2.3.

  • Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.

    Affected: from 3.0.0, fixed in 3.5.2.

  • In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.

    Affected: from 3.0.0, fixed in 3.5.0; from 4.0.0-alpha1, fixed in 4.0.0-alpha2.

  • SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set.

    Affected: from 3.2.0, fixed in 3.2.4.

  • In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,

    Affected: from 2.0.0, fixed in 2.0.5; from 3.1.0, fixed in 3.1.2.