Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data
CVE-2023-44401

5.3MEDIUM

Key Information:

Vendor

Silverstripe

Status
Silverstripe-graphql
Vendor
CVE Published:
23 January 2024

What is CVE-2023-44401?

A vulnerability within the Silverstripe CMS GraphQL Server enables unauthorized access to ORM data due to improperly enforced permission checks on paginated GraphQL query results. This issue affects versions 4.0.0 to 4.3.6 and 5.0.0 to 5.1.2. When the total number of records exceeds the number allowed per page, the canView permission checks can be bypassed, risking exposure of sensitive data. The vulnerability has been addressed in versions 4.3.7 and 5.1.3 by improving permission check mechanisms to ensure compliance with viewing restrictions and achieving consistent pagination behavior across the system.

Affected Version(s)

silverstripe-graphql >= 4.0.0, < 4.3.7 < 4.0.0, 4.3.7

silverstripe-graphql >= 5.0.0, < 5.1.3 < 5.0.0, 5.1.3

References

https://github.com/silverstripe/silverstripe-graphql/secu...
x_refsource_CONFIRM
https://www.silverstripe.org/download/security-releases/C...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.