PT-2024-40400 · Packagist · Silverstripe/Framework

Published 2024-05-27 · Updated 2024-05-27

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned.

Description The issue concerns the storage of user login attempts in a database, specifically in the LoginAttempt table. This table stores information in plain text, which may include sensitive data such as mis-typed user passwords entered into the username field. To address this, a one-way hash is applied to the Email field before it is stored.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

GHSA-PH62-FV59-VF9H

Affected Products

Silverstripe/Framework

References · 7

• https://osv.dev/vulnerability/GHSA-ph62-fv59-vf9h · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2017-009-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/c5d6eb816d4ac5e9fa3d8bc4bd82de95719eb22d · Note
• https://github.com/silverstripe/silverstripe-framework/commit/3e2bcaa0b49277ff7f7004b265a7fa80d0b92e5c · Note
• https://github.com/silverstripe/silverstripe-framework/commit/f1dd3d6f03eb1d94c29c495994a1da9176a758d9 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2017-009 · Note