silverstripe/framework vulnerable to member disclosure in login form
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-200.
Summary
There is a user ID enumeration vulnerability in our brute force error messages. - Users that don't exist in will never get a locked out message - Users that do exist, will get a locked out message This means an attacker can infer or confirm user details that exist in the member table. This issue has been resolved by ensuring that login attempt logging and lockout process works equivalently for non-existent users as it does for existant users. This is a regression of [SS-2017-002](https://www.silverstripe.org/download/security-releases/ss-2017-002).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | silverstripe/framework (Packagist) | 4.0.0-rc1 to before 4.0.4 | 4.0.4 | Patch available | GHSA-crr3-h4m8-7f56 |
| — | silverstripe/framework (Packagist) | 4.1.0-rc1 to before 4.1.1 | 4.1.1 | Patch available | GHSA-crr3-h4m8-7f56 |
- silverstripe/framework (Packagist) Vendor— Affected 4.0.0-rc1 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-crr3-h4m8-7f56
- silverstripe/framework (Packagist) Vendor— Affected 4.1.0-rc1 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-crr3-h4m8-7f56
Remediation
- Fix · GHSA-crr3-h4m8-7f56 silverstripe/framework (Packagist) Fixed in 4.0.4 Advisory →
- Fix · GHSA-crr3-h4m8-7f56 silverstripe/framework (Packagist) Fixed in 4.1.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-crr3-h4m8-7f56
References
Other 4
- https://github.com/silverstripe/silverstripe-framework/commit/5887201dd578a5b9779c33a182153d2ce973ab41
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-010-1.yaml
- https://github.com/silverstripe/silverstripe-framework
- https://www.silverstripe.org/download/security-releases/ss-2018-010
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences