GHSA-r3pr-fh25-wrfc
GHSA-r3pr-fh25-wrfc · silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
When accessing the `install.php` script it is possible to extract any pre-configured database or default admin account password by viewing the source of the page, and inspecting the `value` property of the password fields.
CVSS 6.5 · Media · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
silverstripe/framework Packagist
- Versiones
- 4.0.0
- 4.0.0-rc1
- 4.0.0-rc2
- 4.0.0-rc3
- 4.0.1-rc1
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 4.0.0-rc1, < 4.0.1
Actualiza a 4.0.1
Fuentes originales
- https://github.com/silverstripe/silverstripe-framework/commit/7a79cd039a96ef54182263d5fbb72addf093b171
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2017-010-1.yaml
- https://github.com/silverstripe/silverstripe-framework
- https://www.silverstripe.org/download/security-releases/ss-2017-010
- https://osv.dev/vulnerability/GHSA-r3pr-fh25-wrfc