silverstripe/graphql Denial of Service vulnerability

CVE-2023-28104

What is CVE-2023-28104?

The silverstripe/graphql service allows the representation of Silverstripe data through GraphQL. Certain versions (4.2.2 and 4.1.1) are vulnerable to denial of service attacks due to a flaw that permits an attacker to exploit a carefully crafted GraphQL query. This vulnerability is particularly severe for websites using large or complex GraphQL schemas, where the attack can lead to significant disruption in service availability. It is crucial for users to update to version 4.2.3 or 4.1.2 to mitigate this issue and enhance their site's security.

References