Silverstripe Framework user enumeration via timing attack on login and password reset forms

published 2025-04-10 last yr. modified 2025-04-10 last yr.

cvss: 5.3; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.

This was originally disclosed in https://www.silverstripe.org/download/security-releases/ss-2017-005/ for CMS 3 but was not patched in CMS 4+

### References

- https://www.silverstripe.org/download/security-releases/ss-2017-005 - https://www.silverstripe.org/download/security-releases/ss-2025-001

Patch / fix

fixed in 1 links 1

packagist silverstripe/framework 5.3.23

github.com/silverstripe/silverstripe-framework#11681 pull request

Is GHSA-256q-hx8w-xcqx in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	silverstripe/framework	>=4.0.0, <5.3.23	5.3.23

Classification

Weakness

CWE-204 Observable Response Discrepancy

References

Sources

GitHub Advisory GHSA-256q-hx8w-xcqx

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.