Skip to content
OpenAdvisories

Package · Packagist

silverstripe/graphql

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.3
    CVE-2023-44401

    Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data

    The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, `canView` permission checks are bypassed for ORM data in paginated GraphQL query results where the total number…

    silverstripe silverstripe-graphql silverstripe/graphql Packagist
  • Medium 4.3
    CVE-2021-28661

    SilverStripe GraphQL Server permission checker not inherited by query subclass.

    Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.

    silverstripe/graphql Packagist
  • Medium 6.5
    CVE-2020-26136

    Authentication bypass in SilverStripe GraphQL

    In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.

    silverstripe/graphql Packagist
  • Medium 5.3
    CVE-2020-6165

    Silverstripe has Incorrect Default Permissions

    SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The automatic permission-checking mechanism in the silverstripe/graphql module does not provide complete prot…

    silverstripe/graphql silverstripe/recipe-cms Packagist