PT-2020-18974 · Silverstripe · Silverstripe

Elliot Sawyer · Published 2020-07-15 · Updated 2024-03-06 · CVE-2020-6164

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SilverStripe versions through 4.5.0

Description A specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a SilverStripe application, without revealing the specific version. This functionality is limited to execution in a CLI context and is not known to present a risk through web-based access. Additionally, this preconfigured path blocks the creation of other resources on this path, such as a page.

Recommendations For versions through 4.5.0, consider restricting access to the specific URL path configured by default through the silverstripe/framework module to minimize the risk of disclosure. As a temporary workaround, consider disabling the functionality associated with this URL path until a more permanent solution is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-SILVERSTRIPE-2020-6164

CVE-2020-6164

GHSA-GM5X-HPMW-XPXG

Affected Products

Silverstripe

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2020-6164.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2020-6164 · Vendor Advisory
• https://silverstripe.org/download/security-releases/CVE-2020-6164 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gm5x-hpmw-xpxg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6164 · Security Note
• https://osv.dev/vulnerability/BIT-silverstripe-2020-6164 · Vendor Advisory
• https://github.com/silverstripe/silverstripe-framework/commit/cce2b1630937895aa28c2914837651e7cd56d74b · Note
• https://github.com/silverstripe/silverstripe-framework/commit/91d30db88f68b9b87980ef9a59e208a81980b72c · Note
• https://github.com/silverstripe/silverstripe-cms · Note
• https://t.me/cvenotify/5085 · Telegram Post