GHSA-crr3-h4m8-7f56 – silverstripe/framework

Package

Manager: composer
Name: silverstripe/framework
Vulnerable Version: >=4.0.0-rc1 <4.0.4 || >=4.1.0-rc1 <4.1.1

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: N/A pctlN/A

Details

silverstripe/framework vulnerable to member disclosure in login form There is a user ID enumeration vulnerability in our brute force error messages. - Users that don't exist in will never get a locked out message - Users that do exist, will get a locked out message This means an attacker can infer or confirm user details that exist in the member table. This issue has been resolved by ensuring that login attempt logging and lockout process works equivalently for non-existent users as it does for existant users. This is a regression of [SS-2017-002](https://www.silverstripe.org/download/security-releases/ss-2017-002).

Metadata

Created: 2024-05-27T23:23:51Z
Modified: 2024-05-27T23:23:51Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-crr3-h4m8-7f56/GHSA-crr3-h4m8-7f56.json
CWE IDs: ["CWE-200"]
Alternative ID: N/A
Finding: F310
Auto approve: 1