Read the docs
TI-2024-38758 Aliases GHSA-g84q-cq55-xwgp

silverstripe/framework member disclosure in login form

Priority LOW 38CWE-200Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-200.

Summary

There is a user ID enumeration vulnerability in our brute force error messages. - Users that don't exist in will never get a locked out message - Users that do exist, will get a locked out message This means an attacker can infer or confirm user details that exist in the member table. This issue has been resolved by ensuring that login attempt logging and lockout process works equivalently for non-existent users as it does for existant users.

Why it matters now

Fix Fixed silverstripe/framework (Packagist): 3.4.6, 3.5.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—silverstripe/framework (Packagist)3.4.0-rc1 to before 3.4.63.4.6Patch availableGHSA-g84q-cq55-xwgp
—silverstripe/framework (Packagist)3.5.0-rc1 to before 3.5.43.5.4Patch availableGHSA-g84q-cq55-xwgp
  • silverstripe/framework (Packagist) Vendor— Affected 3.4.0-rc1 to before 3.4.6 Fixed in 3.4.6 Patch available GHSA-g84q-cq55-xwgp
  • silverstripe/framework (Packagist) Vendor— Affected 3.5.0-rc1 to before 3.5.4 Fixed in 3.5.4 Patch available GHSA-g84q-cq55-xwgp

Remediation

  • Fix · GHSA-g84q-cq55-xwgp silverstripe/framework (Packagist) Fixed in 3.4.6 Advisory →
  • Fix · GHSA-g84q-cq55-xwgp silverstripe/framework (Packagist) Fixed in 3.5.4 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-g84q-cq55-xwgp

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences