Silverstripe Framework has missing permission check of canView in GridFieldPrintButton
Priority LOW 21CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00486 42nd percentileScored 2026-11-07
Fix Fixed silverstripe-framework (silverstripe): 4.12.5silverstripe/framework (Packagist): 4.12.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| silverstripe | silverstripe-framework | before 4.12.5 | 4.12.5 | Patch available | CNA |
| — | silverstripe/framework (Packagist) | before 4.12.5 | 4.12.5 | Patch available | GHSA-jh3w-6jp2-vqqm |
- silverstripe-framework Vendorsilverstripe Affected before 4.12.5 Fixed in 4.12.5 Patch available CNA
- silverstripe/framework (Packagist) Vendor— Affected before 4.12.5 Fixed in 4.12.5 Patch available GHSA-jh3w-6jp2-vqqm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:* | before 4.12.5 | Vulnerable | silverstripe |
- cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:* Versions before 4.12.5 Vulnerable ·silverstripe
Remediation
- Fix · CNA silverstripe-framework (silverstripe) Fixed in 4.12.5
- Fix · GHSA-jh3w-6jp2-vqqm silverstripe/framework (Packagist) Fixed in 4.12.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-22728
- 2026-10-03 Alias added: GHSA-jh3w-6jp2-vqqm
References
Advisory 2
More silverstripe Framework vulnerabilities
- TI-2022-17852 Silverstripe silverstripe/framework through 4.11 allows SQL Injection. CVSS 3.1HIGH 8.8
- TI-2023-08903 Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen CVSS 3.1MEDIUM 6.1
- TI-2022-18086 Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully… CVSS 3.1MEDIUM 6.1
- TI-2022-18248 Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0… CVSS 3.1MEDIUM 5.4
- TI-2022-08949 Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that… CVSS 3.1MEDIUM 5.4
- TI-2022-17851 Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3). CVSS 3.1MEDIUM 5.4
Sources
- CVE-2023-22728 · CVE Program
- CVE-2023-22728 · NVD
- FIRST EPSS
- GHSA-jh3w-6jp2-vqqm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences