PT-2024-40256 · Packagist · Silverstripe/Framework

Published 2024-05-27 · Updated 2024-05-27

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned.

Description: A weakness in the .htaccess rules allows PHP scripts in the assets directory to be executed through a specially crafted URL. However, protections are in place to prevent the upload of PHP scripts through the CMS, and additional configuration on certain platforms prevents PHP script execution in assets.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

GHSA-F43J-8HQ4-2XJ9

Affected Products

Silverstripe/Framework

References · 5

• https://osv.dev/vulnerability/GHSA-f43j-8hq4-2xj9 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-012-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/5b7eca2b6327556e2d5ad31bb00511b187e5992a · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2018-012 · Note