PT-2019-12695 · Silverstripe · Silverstripe

Steve Boyd · Publicado 2019-09-25 · Atualizado 2020-08-24 · CVE-2019-12204

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SilverStripe versions prior to 4.4

Description The issue arises from a missing warning about leaving install.php in a public webroot, which can lead to unauthenticated admin access.

Recommendations For SilverStripe versions prior to 4.4, remove or restrict access to install.php to prevent unauthenticated admin access.

Exploit

Correção

Identificadores relacionados

CVE-2019-12204

GHSA-CG8J-8W52-735V

Produtos afetados

Silverstripe

Referências · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-12204.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12204 · Nota de Segurança
• https://forum.silverstripe.org/c/releases · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12204 · Nota
• https://packagist.org/packages/silverstripe/framework · Nota
• https://packagist.org/packages/silverstripe/cms · Nota
• https://osv.dev/vulnerability/GHSA-cg8j-8w52-735v · Aviso do Fabricante
• https://silverstripe.org/download/security-releases/CVE-2019-12204 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-12204 · Aviso do Fabricante
• https://silverstripe.org/download/security-releases · Aviso do Fabricante
• https://silverstripe.org/download/security-releases/cve-2019-12204 · Nota