Read the docs
TI-2025-43638 Aliases GHSA-256q-hx8w-xcqx

Silverstripe Framework user enumeration via timing attack on login and password reset forms

Priority LOW 38CWE-204Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-204.

Summary

### Impact User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials. This was originally disclosed in https://www.silverstripe.org/download/security-releases/ss-2017-005/ for CMS 3 but was not patched in CMS 4+ ### References - https://www.silverstripe.org/download/security-releases/ss-2017-005 - https://www.silverstripe.org/download/security-releases/ss-2025-001

Why it matters now

Fix Fixed silverstripe/framework (Packagist): 5.3.23

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—silverstripe/framework (Packagist)4.0.0 to before 5.3.235.3.23Patch availableGHSA-256q-hx8w-xcqx
  • silverstripe/framework (Packagist) Vendor— Affected 4.0.0 to before 5.3.23 Fixed in 5.3.23 Patch available GHSA-256q-hx8w-xcqx

Remediation

  • Fix · GHSA-256q-hx8w-xcqx silverstripe/framework (Packagist) Fixed in 5.3.23 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-256q-hx8w-xcqx

References

Advisory 1

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences