CVE-2023-40180 json
Denial of service vulnerability in silverstripe-graphql via recursive queries
published 2023-10-16 3 y ago modified 2026-09-10 1 mo ago also GHSA-v23w-pppm-jh66 , EUVD-2023-2810
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If your Silverstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attack. If your site is hosted behind a content delivery network (CDN), such as Imperva or CloudFlare, this may further mitigate the risk. This issue has been addressed in versions 3.8.2, 4.1.3, 4.2.5, 4.3.4, and 5.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- packagist silverstripe/graphql 3.8.2, 4.1.3, 4.2.5, 4.3.4, 5.0.3
- silverstripe graphql 3.8.2, 4.1.3, 4.2.5, 4.3.4, 5.0.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | silverstripe/graphql | >=3.0.0, <3.8.2 >=4.0.0, <4.1.3 >=4.2.0, <4.2.5 >=4.3.0, <4.3.4 >=5.0.0, <5.0.3 |
3.8.2 4.1.3 4.2.5 4.3.4 5.0.3 |
Affected products
- silverstripe silverstripe-graphql
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/silverstripe/silverstripe-graphql/commit/f6d5976ec4608e51184b0db1ee5b9e9a99d2501c
web, patch
-
silverstripe.org
/download/security-releases/CVE-2023-40180
web, vendor-advisory
-
github.com
/silverstripe/silverstripe-graphql/security/advisories/GHSA-v23w-pppm-jh66
web, third-party-advisory
-
docs.silverstripe.org
/en/developer_guides/graphql/security_and_best_practices/recursive_or_complex_queries
web, mitigation
-
github.com
/silverstripe/silverstripe-graphql/tree/3.8#recursive-or-complex-queries
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-40180
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2023-40180.yaml
web
-
github.com
/silverstripe/silverstripe-graphql
package
Sources
- CVE List CVE-2023-40180
- GitHub Advisory GHSA-v23w-pppm-jh66
- NVD CVE-2023-40180
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.