PT-2024-40294 · Packagist · Silverstripe/Framework

Published 2024-05-27 · Updated 2024-05-27

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned, so: Software (affected versions not specified)

Description: The issue concerns a user ID enumeration vulnerability in brute force error messages. It allows an attacker to infer or confirm user details that exist in the member table by exploiting the difference in login attempt logging and lockout processes for non-existent and existent users. This vulnerability has been resolved by ensuring that the login attempt logging and lockout process works equivalently for both non-existent and existent users.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-G84Q-CQ55-XWGP

Affected Products

Silverstripe/Framework

References · 5

• https://osv.dev/vulnerability/GHSA-g84q-cq55-xwgp · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2017-002-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/f71efb5063c57d823dd130b9bfd018f6ef903d49 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2017-002 · Note