p PatchFirst

GHSA-7m2v-x7rg-5hm5

GHSA-7m2v-x7rg-5hm5 · silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms

This page contains facts from public vulnerability sources. Check the original advisory before updating.

User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.

Fix available

Published
Updated

Stack: php

Affected products and versions

  • silverstripe/framework Packagist

    Versions
    • 3.5.0
    • 3.5.0-rc1
    • 3.5.0-rc2
    • 3.5.0-rc3
    • 3.5.1
    • 3.5.1-rc1
    • 3.5.1-rc2
    • 3.5.2
    • 3.5.2-rc1
    • 3.5.3
    • 3.5.3-rc1
    • 3.5.4
    • 3.5.4-rc1
    • 3.5.5-beta1
    • 3.5.5-beta2
    Affected ranges
    • ECOSYSTEM: ≥ 3.5.0-rc1, < 3.5.5

    Update to 3.5.5

  • silverstripe/framework Packagist

    Versions
    • 3.6.0
    • 3.6.0-rc1
    • 3.6.1
    • 3.6.1-alpha2
    • 3.6.2-beta1
    • 3.6.2-beta2
    Affected ranges
    • ECOSYSTEM: ≥ 3.6.0-rc1, < 3.6.2

    Update to 3.6.2

Original sources

Check your server →