PT-2019-12695 · Silverstripe · Silverstripe

Steve Boyd · CVE-2019-12204 · Published 2019-09-25 · Updated 2020-08-24

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SilverStripe versions prior to 4.4

Description The issue arises from a missing warning about leaving install.php in a public webroot, which can lead to unauthenticated admin access.

Recommendations For SilverStripe versions prior to 4.4, remove or restrict access to install.php to prevent unauthenticated admin access.

Exploit

Fix

Related Identifiers

CVE-2019-12204

GHSA-CG8J-8W52-735V

Affected Products

Silverstripe

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-12204.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12204 · Security Note
• https://forum.silverstripe.org/c/releases · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cg8j-8w52-735v · Vendor Advisory
• https://silverstripe.org/download/security-releases/CVE-2019-12204 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12204 · Vendor Advisory
• https://silverstripe.org/download/security-releases · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12204 · Note
• https://packagist.org/packages/silverstripe/framework · Note
• https://packagist.org/packages/silverstripe/cms · Note
• https://silverstripe.org/download/security-releases/cve-2019-12204 · Note