p PatchFirst

PatchFirst · Latest vulnerabilities

silverstripe/framework vulnerabilities · Page 2

Vulnerabilities published for silverstripe/framework in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 93

  1. GHSA-55qg-6c4m-mw6g

    Medium · CVSS 6.5Fix available

    silverstripe/framework's URL parameters `isDev` and `isTest` unguarded

    The URL parameters `isDev` and `isTest` are accessible to unauthenticated users who access a SilverStripe website or application. This allows unauthorised users to expose information that is usually hidden on production environments such as verbose errors (including backtraces) and other debugging tools only available to sites running in "dev mode". Core functionality does not expose user data through these methods. Depending on your website configuration, community modules might have added more specific functionality which can be used to either access or alter user data. We have fixed the usage of isDev and isTest in SilverStripe 4.x, and r

    silverstripe/framework silverstripe/frameworkPHP
    • Update to 4.0.4
    • Update to 4.1.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. GHSA-xx4r-5265-48j6

    High · CVSS 8.8Fix available

    silverstripe/framework SQL injection in full text search

    When performing a fulltext search in SilverStripe 4.0.0 the 'start' querystring parameter is never escaped safely. This exposes a possible SQL injection vulnerability. The issue exists in 3.5 and 3.6 but is less vulnerable, as SearchForm sanitises these variables prior to passing to mysql.

    silverstripe/framework silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.5.6
    • Update to 3.6.3
    • Update to 4.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. GHSA-ph62-fv59-vf9h

    Medium · CVSS 6.5Fix available

    silverstripe/framework users inadvertently passing sensitive data to LoginAttempt

    All user login attempts are logged in the database in the LoginAttempt table. However, this table contains information in plain text, and may possible contain sensitive information, such as user passwords mis-typed into the username field. In order to address this a one-way hash is applied to the Email field before being stored.

    silverstripe/framework silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.5.6
    • Update to 3.6.3
    • Update to 4.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. GHSA-mqjc-x563-c9q8

    High · CVSS 8Fix available

    silverstripe/framework CSV Excel Macro Injection

    In the CSV export feature of the CMS it's possible for the output to contain macros and scripts, which if imported without sanitisation into software (including Microsoft Excel) may be executed. In order to safeguard against this threat all potentially executable cell values exported from CSV will be prepended with a literal tab character.

    silverstripe/framework silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.5.6
    • Update to 3.6.3
    • Update to 4.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. GHSA-4qx8-j9vh-2628

    High · CVSS 7.5Fix available

    silverstripe/framework's User-Agent header not correctly invalidating user session

    A security protection device in Session designed to protect session hijacking was not correctly functioning. This function intended to protect user sessions by detecting changes in the User-Agent header, but modifications to this header were not correctly invalidating the user session.

    silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.5.6
    • Update to 3.6.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. GHSA-pp7q-6j3f-74vj

    Medium · CVSS 6.1Fix available

    silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage

    RedirectorPage will allow users to specify a non-url malicious script as the redirection path without validation. Users which follow this url may allow this script to execute within their browser.

    silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.4.6
    • Update to 3.5.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. GHSA-r85g-7jpv-8xrx

    Medium · CVSS 6.1Fix available

    silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL

    In follow up to [SS-2016-001](https://www.silverstripe.org/download/security-releases/ss-2016-001/) there is yet a minor unresolved fix to incorrectly encoded URL.

    silverstripe/framework silverstripe/framework silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.1.21
    • Update to 3.2.6
    • Update to 3.3.4
    • Update to 3.4.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. GHSA-g84q-cq55-xwgp

    Medium · CVSS 5.3Fix available

    silverstripe/framework member disclosure in login form

    There is a user ID enumeration vulnerability in our brute force error messages. - Users that don't exist in will never get a locked out message - Users that do exist, will get a locked out message This means an attacker can infer or confirm user details that exist in the member table. This issue has been resolved by ensuring that login attempt logging and lockout process works equivalently for non-existent users as it does for existant users.

    silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.4.6
    • Update to 3.5.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. GHSA-468j-6jrc-2rjx

    Medium · CVSS 6.1Fix available

    silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField`

    List of key / value pairs assigned to `OptionsetField` or `CheckboxSetField` do not have a default casting assigned to them. The effect of this is a potential XSS vulnerability in lists where either key or value contain unescaped HTML.

    silverstripe/framework silverstripe/framework silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.1.20
    • Update to 3.2.5
    • Update to 3.3.3
    • Update to 3.4.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. GHSA-r9vp-fp72-xgf7

    Medium · CVSS 5.4Fix available

    silverstripe/framework's `Member.Name` is not escaped

    The core template `framework/templates/Includes/GridField_print.ss` uses "Printed by $Member.Name". If the currently logged in members first name or surname contain XSS, this prints the raw HTML out, because Member->getName() just returns the raw FirstName + Surname as a string, which is injected directly.

    silverstripe/framework silverstripe/framework silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.1.20
    • Update to 3.2.5
    • Update to 3.3.3
    • Update to 3.4.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. GHSA-5r8w-66hq-rc39

    Low · CVSS 3.1Fix available

    silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled

    If remember me is on and users log in with the box checked, if the developer then disabled "remember me" function, any pre-existing cookies will continue to authenticate users.

    silverstripe/framework silverstripe/framework silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.1.20
    • Update to 3.2.5
    • Update to 3.3.3
    • Update to 3.4.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. GHSA-52cx-hpc5-cxwc

    Medium · CVSS 4.3Fix available

    silverstripe/framework missing ACL on reports

    The SS_Report, and the reports CMS section only checks `canView()` when listing the reports that can be viewed by the current user. It does not (and should) perform `canView` checks when the report is actually viewed, so if you know the URL to a report and can otherwise access the Reports section of the CMS, you can view any report.

    silverstripe/framework silverstripe/framework silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.1.20
    • Update to 3.2.5
    • Update to 3.3.3
    • Update to 3.4.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. GHSA-p5h2-vr99-xm99

    Medium · CVSS 4.3Fix available

    silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()`

    After performing a password reset, `ChangePasswordForm::doChangePassword()` logs in the user without checking `Member::canLogIn()`. This presents an issue for sites that are using the extension point in that method to deny access to users (for example members that have not been “approved”, or members that have had their access revoked temporarily). It looks like `Member::canLogIn()` was originally designed to only be used for checking whether the user is locked out (due to too many incorrect login attempts) but has been opened up to other uses.

    silverstripe/framework silverstripe/framework silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.1.20
    • Update to 3.2.5
    • Update to 3.3.3
    • Update to 3.4.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. GHSA-f3wp-xpv2-6vmg

    Not ratedFix available

    silverstripe/framework password encryption salt not updated

    When a user changes their password, the internal salt used for hashing their password is not updated. Although this is not considered a security vulnerability, this behaviour has been improved to ensure the salt is reset on change of password.

    silverstripe/framework silverstripe/framework silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.1.20
    • Update to 3.2.5
    • Update to 3.3.3
    • Update to 3.4.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. GHSA-97jm-g33h-f46g

    Medium · CVSS 6.1Fix available

    silverstripe/framework ReadOnly transformation for formfields exploitable

    Form fields returning isReadonly() as true are vulnerable to reflected XSS injections. This includes ReadonlyField, LookupField, HTMLReadonlyField, as well as special purpose fields like TimeField_Readonly. Values submitted to through these form fields are not filtered out from the form session data, and might be shown to the user depending on the form behaviour. For example, form validation errors cause the form to re-render with previously submitted values by default. SilverStripe forms automatically load values from request data (GET and POST), which enables malicious use of URLs if your form uses these fields and doesn't overwrite data o

    silverstripe/framework silverstripe/framework silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.1.21
    • Update to 3.2.6
    • Update to 3.3.4
    • Update to 3.4.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. GHSA-mpqj-f4v3-334h

    Medium · CVSS 6.1Fix available

    Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter

    A cross-site scripting vulnerability in VersionedRequestFilter has been found. If an incoming user request should not be able to access the requested stage, an error message is created for display on the CMS login page that they are redirected to. In this error message, the URL of the requested page is interpolated into the error message without being escaped; hence, arbitrary HTML can be injected into the CMS login page.

    silverstripe/framework silverstripe/frameworkPHP
    • Update to 3.3.3
    • Update to 3.4.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →