PT-2024-40479 · Osv · Osv

Published 2024-05-27 · Updated 2024-05-27

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OSV (affected versions not specified)

Description The issue concerns a form that may populate a PasswordField with submitted data, reflecting it back to the user. This behavior is not considered best practice, as it may expose the user's own password submissions. However, there is no indication of data leaks to other users, devices, or sessions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-VH7Q-J8P5-2H4H

Affected Products

Osv

References · 6

• https://osv.dev/vulnerability/GHSA-vh7q-j8p5-2h4h · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-013-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/c28f411abd4837cdd9dbf87c4457976e678131cb · Note
• https://github.com/silverstripe/silverstripe-framework/commit/f688bcb1a370e41df1b573a24fa3994b3895bacf · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2018-013 · Note