GHSA-r3pr-fh25-wrfc
GHSA-r3pr-fh25-wrfc · silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
When accessing the `install.php` script it is possible to extract any pre-configured database or default admin account password by viewing the source of the page, and inspecting the `value` property of the password fields.
CVSS 6.5 · Moyenne · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
silverstripe/framework Packagist
- Versions du logiciel
- 4.0.0
- 4.0.0-rc1
- 4.0.0-rc2
- 4.0.0-rc3
- 4.0.1-rc1
- Plages de versions concernées
- ECOSYSTEM: ≥ 4.0.0-rc1, < 4.0.1
Mettez à jour vers 4.0.1
Sources originales
- https://github.com/silverstripe/silverstripe-framework/commit/7a79cd039a96ef54182263d5fbb72addf093b171
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2017-010-1.yaml
- https://github.com/silverstripe/silverstripe-framework
- https://www.silverstripe.org/download/security-releases/ss-2017-010
- https://osv.dev/vulnerability/GHSA-r3pr-fh25-wrfc