PT-2024-40358 · Silverstripe · Silverstripe

Published 2024-05-28 · Updated 2024-05-28

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SilverStripe versions 3.7 through 4.x

Description The issue potentially discloses database connection details when SilverStripe is run in dev mode using the mysqli database driver. To mitigate this, sensitive parts of the connection information have been blacklisted from being included in dev mode stack traces when database errors occur.

Recommendations For SilverStripe versions 3.7 through 4.x, consider running the application outside of dev mode to minimize the risk of connection detail disclosure. As a temporary workaround, ensure that the blacklisting of sensitive connection information is properly configured to prevent exposure in dev mode stack traces.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

GHSA-M2HH-2M46-X6J5

Affected Products

Silverstripe

References · 7

• https://osv.dev/vulnerability/GHSA-m2hh-2m46-x6j5 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-018-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/54251952387394d72b221e797a80edfbf9a973ee · Note
• https://github.com/silverstripe/silverstripe-framework/commit/214e28127f5425b61c15b69f884afdbad31133c2 · Note
• https://github.com/silverstripe/silverstripe-framework/commit/9aabe0a0f7a061d87cc92923f8811e14d7a032f5 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2018-018 · Note