GHSA-256q-hx8w-xcqxmedium5.3No CVE assigned
Silverstripe Framework user enumeration via timing attack on login and password reset forms
Impact
User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
silverstripe/framework Packagist
| Affected range | Recorded fix |
|---|---|
| From 4.0.0 before 5.3.23Ecosystem versions | 5.3.23 |
Version evidence: OSV · GHSA-256q-hx8w-xcqx
View original version evidence (269 explicit versions)
Original source description
Impact
User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.
This was originally disclosed in https://www.silverstripe.org/download/security-releases/ss-2017-005/ for CMS 3 but was not patched in CMS 4+
References
References
- Security advisory github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-256q-hx8w-xcqx
- Security advisory nvd.nist.gov/vuln/detail/CVE-2017-12849
- Patch github.com/silverstripe/silverstripe-framework/pull/11681
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2025-001.yaml
- Source reference github.com/silverstripe/silverstripe-framework
- Security advisory www.silverstripe.org/download/security-releases/ss-2017-005
- Security advisory www.silverstripe.org/download/security-releases/ss-2025-001