Read the docs
TI-2024-38763 Aliases GHSA-4qx8-j9vh-2628

silverstripe/framework's User-Agent header not correctly invalidating user session

Priority LOW 38CWE-384Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Spoofing
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-384.

Summary

A security protection device in Session designed to protect session hijacking was not correctly functioning. This function intended to protect user sessions by detecting changes in the User-Agent header, but modifications to this header were not correctly invalidating the user session.

Why it matters now

Fix Fixed silverstripe/framework (Packagist): 3.5.6, 3.6.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—silverstripe/framework (Packagist)3.5.0-rc1 to before 3.5.63.5.6Patch availableGHSA-4qx8-j9vh-2628
—silverstripe/framework (Packagist)3.6.0-rc1 to before 3.6.33.6.3Patch availableGHSA-4qx8-j9vh-2628
  • silverstripe/framework (Packagist) Vendor— Affected 3.5.0-rc1 to before 3.5.6 Fixed in 3.5.6 Patch available GHSA-4qx8-j9vh-2628
  • silverstripe/framework (Packagist) Vendor— Affected 3.6.0-rc1 to before 3.6.3 Fixed in 3.6.3 Patch available GHSA-4qx8-j9vh-2628

Remediation

  • Fix · GHSA-4qx8-j9vh-2628 silverstripe/framework (Packagist) Fixed in 3.5.6 Advisory →
  • Fix · GHSA-4qx8-j9vh-2628 silverstripe/framework (Packagist) Fixed in 3.6.3 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-4qx8-j9vh-2628

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences