PT-2024-13629 · Silverstripe · Silverstripe/Framework

Nick K · Published 2024-01-23 · Updated 2024-02-02 · CVE-2023-48714

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe Framework versions prior to 4.13.39 and 5.1.11

Description The issue allows a user to access a record's title even if they should not be able to see the record, by adding it to a GridField using the GridFieldAddExistingAutocompleter component.

Recommendations For versions prior to 4.13.39, update to version 4.13.39 or later. For versions prior to 5.1.11, update to version 5.1.11 or later.

Exploit

Fix

Information Disclosure

Incorrect Permission

Weakness Enumeration

CWE-200

CWE-732

Related Identifiers

CVE-2023-48714

GHSA-QM2J-QVQ3-J29V

Affected Products

Silverstripe/Framework

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48714.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2023-48714.yaml · Exploit
• https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-qm2j-qvq3-j29v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48714 · Vendor Advisory
• https://silverstripe.org/download/security-releases/CVE-2023-48714 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48714 · Security Note
• https://osv.dev/vulnerability/GHSA-qm2j-qvq3-j29v · Vendor Advisory
• https://github.com/silverstripe/silverstripe-framework · Note
• https://t.me/cvenotify/68372 · Telegram Post
• https://t.me/cvenotify/69711 · Telegram Post