GHSA-vh7q-j8p5-2h4h json
silverstripe/framework sends passwords back to browsers under some circumstances
published 2y ago modified last yr.
- cvss
- 3.5
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Under some circumstances a form may populate a PasswordField with submitted data, reflecting submitted data back to a user. The user will only see their own submissions for password data, which is not considered best practice. We are not aware of data leaks to other users, devices or sessions.
Patch / fix
- packagist silverstripe/framework 3.7.0, 4.0.4, 4.1.1
Is GHSA-vh7q-j8p5-2h4h in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 3.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | silverstripe/framework | >=3.5.5-rc1, <3.7.0 >=4.0.3-rc1, <4.0.4 >=4.1.0-rc1, <4.1.1 |
3.7.0 4.0.4 4.1.1 |
References
-
github.com
/silverstripe/silverstripe-framework/commit/c28f411abd4837cdd9dbf87c4457976e678131cb
web
-
github.com
/silverstripe/silverstripe-framework/commit/f688bcb1a370e41df1b573a24fa3994b3895bacf
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-013-1.yaml
web
-
github.com
/silverstripe/silverstripe-framework
package
-
silverstripe.org
/download/security-releases/ss-2018-013
web
Sources
- GitHub Advisory GHSA-vh7q-j8p5-2h4h
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.