CVE-2020-6164: Silverstripe CMS Information Disclosure
Summary
CVE-2020-6164: Silverstripe CMS information disclosure. Affects silverstripe/cms versions < 4.5.0. No fix is published. How to fix ↓
Also tracked for
- silverstripe · Bitnami
The same CVE-2020-6164 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Silverstripe CMS is a popular content management system used for building websites and web applications. It provides a framework for developers to create and manage content, templates, and user interactions. The CMS is built on top of the Silverstripe framework module, which provides core functionality and features. This vulnerability affects Silverstripe CMS versions up to 4.5.0.
Vulnerability Detail
The vulnerability in Silverstripe CMS allows an attacker to determine if a domain is hosting a Silverstripe application. By accessing a specific URL path, the attacker can identify the presence of Silverstripe CMS, but the specific version is not disclosed. This URL path is only accessible in a CLI context and does not pose a risk through web-based access. However, it also prevents the creation of other resources on this path, such as a page. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Silverstripe CMS allows an attacker to determine if a domain is hosting a Silverstripe application. It is important to update to the latest version of Silverstripe CMS and review the application's configuration to ensure the protection of sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/cms →
FAQ
Silverstripe CMS is a content management system used for building websites and web applications. It provides a framework for developers to create and manage content, templates, and user interactions.
The vulnerability allows an attacker to determine if a domain is hosting a Silverstripe application. While the specific version is not disclosed, this information can be used for targeted attacks or to exploit known vulnerabilities in older versions of Silverstripe CMS.
No, the vulnerability is limited to execution in a CLI context and does not pose a risk through web-based access.
Updating Silverstripe CMS to version 4.5.0 or later is the recommended mitigation for this vulnerability. It is also important to review the application's configuration and ensure that sensitive information is not exposed through other means.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
