PT-2024-40090 · Silverstripe · Silverstripe

Published 2024-05-27 · Updated 2024-05-27

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SilverStripe versions prior to 4.x

Description: The issue allows unauthorized users to expose information typically hidden in production environments, such as verbose errors and debugging tools, by accessing certain URL parameters. This is possible because the isDev and isTest URL parameters are accessible to unauthenticated users. While core functionality does not expose user data, community modules might have added specific functionality that could be used to access or alter user data.

Recommendations: For SilverStripe versions prior to 4.x, update to version 4.x to fix the usage of isDev and isTest parameters. For the next major release of SilverStripe, the URL parameters isDev and isTest have been removed, so updating to this version will also resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-55QG-6C4M-MW6G

Affected Products

Silverstripe

References · 5

• https://osv.dev/vulnerability/GHSA-55qg-6c4m-mw6g · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-005-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/d935140a9528a3a42323b51d84fb2bcd3da065a7 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2018-005 · Note