PT-2024-40165 · Packagist · Silverstripe/Framework

Published 2024-05-27 · Updated 2024-05-27

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned.

Description: The issue allows user enumeration through a timing attack on the login or password reset pages using user credentials.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-7M2V-X7RG-5HM5

Affected Products

Silverstripe/Framework

References · 5

• https://osv.dev/vulnerability/GHSA-7m2v-x7rg-5hm5 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2017-005-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/f0262a8fd9ab5fb51b178ace3c3487351217f5a0 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2017-005 · Note