graphql vulnerabilities and fixes

Recent CVEs affecting graphql, with upgrade or downgrade steps. 4 tracked.

graphql has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2024-01-23. Highest priority: CVE-2023-40180 (score 48/100).

• CVE-2023-44401 MEDIUM 5.3 UPGRADE The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations
• CVE-2023-40180 HIGH 7.5 UPGRADE silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations
• CVE-2023-28104 HIGH 7.5 DOWNGRADE `silverstripe/graphql` serves Silverstripe data as GraphQL representations
• CVE-2023-26144 MEDIUM 5.3 UPGRADE Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to

FAQ

How do I fix graphql vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is graphql being exploited right now?

None of the tracked graphql CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which graphql CVE should I patch first?

CVE-2023-40180 currently ranks highest (48/100): silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations.

RSS feed for graphql · ← Back to latest CVEs