Read the docs
TI-2023-21053 Aliases CVE-2023-40180GHSA-v23w-pppm-jh66

Denial of service vulnerability in silverstripe-graphql via recursive queries

Priority LOW 35CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. An attacker could use a recursive graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed graphql schemas. If your Silverstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attack. If your site is hosted behind a content delivery network (CDN), such as Imperva or CloudFlare, this may further mitigate the risk. This issue has been addressed in versions 3.8.2, 4.1.3, 4.2.5, 4.3.4, and 5.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01126 66th percentileScored 2026-11-07
Fix Fixed silverstripe-graphql (silverstripe): 3.8.2, 4.1.3, 4.2.5 +2silverstripe/graphql (Packagist): 3.8.2, 4.1.3, 4.2.5 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
silverstripesilverstripe-graphql3.0.0 to before 3.8.2; 4.0.0 to before 4.1.3; 4.2.0 to before 4.2.5; 4.3.0 to before 4.3.4; 5.0.0 to before 5.0.33.8.2, 4.1.3, 4.2.5, 4.3.4, 5.0.3Patch availableCNA
—silverstripe/graphql (Packagist)3.0.0 to before 3.8.23.8.2Patch availableGHSA-v23w-pppm-jh66
—silverstripe/graphql (Packagist)4.0.0 to before 4.1.34.1.3Patch availableGHSA-v23w-pppm-jh66
—silverstripe/graphql (Packagist)4.2.0 to before 4.2.54.2.5Patch availableGHSA-v23w-pppm-jh66
—silverstripe/graphql (Packagist)4.3.0 to before 4.3.44.3.4Patch availableGHSA-v23w-pppm-jh66
—silverstripe/graphql (Packagist)5.0.0 to before 5.0.35.0.3Patch availableGHSA-v23w-pppm-jh66
  • silverstripe-graphql Vendorsilverstripe Affected 3.0.0 to before 3.8.2; 4.0.0 to before 4.1.3; 4.2.0 to before 4.2.5; 4.3.0 to before 4.3.4; 5.0.0 to before 5.0.3 Fixed in 3.8.2, 4.1.3, 4.2.5, 4.3.4, 5.0.3 Patch available CNA
  • silverstripe/graphql (Packagist) Vendor— Affected 3.0.0 to before 3.8.2 Fixed in 3.8.2 Patch available GHSA-v23w-pppm-jh66
  • silverstripe/graphql (Packagist) Vendor— Affected 4.0.0 to before 4.1.3 Fixed in 4.1.3 Patch available GHSA-v23w-pppm-jh66
  • silverstripe/graphql (Packagist) Vendor— Affected 4.2.0 to before 4.2.5 Fixed in 4.2.5 Patch available GHSA-v23w-pppm-jh66
  • silverstripe/graphql (Packagist) Vendor— Affected 4.3.0 to before 4.3.4 Fixed in 4.3.4 Patch available GHSA-v23w-pppm-jh66
  • silverstripe/graphql (Packagist) Vendor— Affected 5.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-v23w-pppm-jh66

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:silverstripe:graphql:*:*:*:*:*:*:*:*3.0.0 to before 3.8.2; 4.0.0 to before 4.1.3; 4.2.0 to before 4.2.5; 4.3.0 to before 4.3.4; 5.0.0 to before 5.0.3Vulnerablesilverstripe
  • cpe:2.3:a:silverstripe:graphql:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.8.2; 4.0.0 to before 4.1.3; 4.2.0 to before 4.2.5; 4.3.0 to before 4.3.4; 5.0.0 to before 5.0.3 Vulnerable ·silverstripe

Remediation

  • Fix · CNA silverstripe-graphql (silverstripe) Fixed in 3.8.2, 4.1.3, 4.2.5, 4.3.4, 5.0.3
  • Fix · GHSA-v23w-pppm-jh66 silverstripe/graphql (Packagist) Fixed in 3.8.2 Advisory →
  • Fix · GHSA-v23w-pppm-jh66 silverstripe/graphql (Packagist) Fixed in 4.1.3 Advisory →
  • Fix · GHSA-v23w-pppm-jh66 silverstripe/graphql (Packagist) Fixed in 4.2.5 Advisory →
  • Fix · GHSA-v23w-pppm-jh66 silverstripe/graphql (Packagist) Fixed in 4.3.4 Advisory →
  • Fix · GHSA-v23w-pppm-jh66 silverstripe/graphql (Packagist) Fixed in 5.0.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40180
  2. 2026-10-03 Alias added: GHSA-v23w-pppm-jh66

References

Patch 1

Advisory 4

Other 3

  • TI-2023-12683 silverstripe/graphql Denial of Service vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-23907 Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences