silverstripe/framework sends passwords back to browsers under some circumstances
Priority LOW 38Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
Under some circumstances a form may populate a PasswordField with submitted data, reflecting submitted data back to a user. The user will only see their own submissions for password data, which is not considered best practice. We are not aware of data leaks to other users, devices or sessions.
Why it matters now
Fix Fixed silverstripe/framework (Packagist): 3.7.0, 4.0.4, 4.1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | silverstripe/framework (Packagist) | 3.5.5-rc1 to before 3.7.0 | 3.7.0 | Patch available | GHSA-vh7q-j8p5-2h4h |
| — | silverstripe/framework (Packagist) | 4.0.3-rc1 to before 4.0.4 | 4.0.4 | Patch available | GHSA-vh7q-j8p5-2h4h |
| — | silverstripe/framework (Packagist) | 4.1.0-rc1 to before 4.1.1 | 4.1.1 | Patch available | GHSA-vh7q-j8p5-2h4h |
- silverstripe/framework (Packagist) Vendor— Affected 3.5.5-rc1 to before 3.7.0 Fixed in 3.7.0 Patch available GHSA-vh7q-j8p5-2h4h
- silverstripe/framework (Packagist) Vendor— Affected 4.0.3-rc1 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-vh7q-j8p5-2h4h
- silverstripe/framework (Packagist) Vendor— Affected 4.1.0-rc1 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-vh7q-j8p5-2h4h
Remediation
- Fix · GHSA-vh7q-j8p5-2h4h silverstripe/framework (Packagist) Fixed in 3.7.0 Advisory →
- Fix · GHSA-vh7q-j8p5-2h4h silverstripe/framework (Packagist) Fixed in 4.0.4 Advisory →
- Fix · GHSA-vh7q-j8p5-2h4h silverstripe/framework (Packagist) Fixed in 4.1.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-vh7q-j8p5-2h4h
References
Other 5
- https://github.com/silverstripe/silverstripe-framework/commit/c28f411abd4837cdd9dbf87c4457976e678131cb
- https://github.com/silverstripe/silverstripe-framework/commit/f688bcb1a370e41df1b573a24fa3994b3895bacf
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-013-1.yaml
- https://github.com/silverstripe/silverstripe-framework
- https://www.silverstripe.org/download/security-releases/ss-2018-013
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences