Sensitive Data Exposure in silverstripe/framework
Summary
GHSA-ph62-fv59-vf9h: silverstripe/framework users inadvertently passing sensitive data to LoginAttempt. Affects silverstripe/framework across 3 version ranges.
>= 3.5.0-rc1, < 3.5.6
>= 3.6.0-rc1, < 3.6.3
>= 4.0.0-rc1, < 4.0.1
Fixed in 3.5.6, 3.6.3 or 4.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
silverstripe/framework is an open-source PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers, including user authentication and login functionality. However, a vulnerability has been identified in versions 3.5.0-rc1 to 3.5.6, 3.6.0-rc1 to 3.6.3, and 4.0.0-rc1 to 4.0.1 of the framework.
Vulnerability Detail
The vulnerability, identified as GHSA-ph62-fv59-vf9h, involves the inadvertent logging of sensitive data in plain text in the LoginAttempt table of the database. This table stores information about user login attempts, including potentially sensitive data such as passwords mistyped into the username field. This poses a risk as the sensitive information is stored without proper encryption or protection. To address this issue, a one-way hash is now applied to the Email field before being stored.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.5.0-rc1, < 3.5.63.5.6composer require silverstripe/framework:3.5.6 -
>= 3.6.0-rc1, < 3.6.33.6.3composer require silverstripe/framework:3.6.3 -
>= 4.0.0-rc1, < 4.0.14.0.1composer require silverstripe/framework:4.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround for this vulnerability. Upgrading to the patched versions is the recommended solution.
Conclusion
In conclusion, the silverstripe/framework package is vulnerable to a sensitive data exposure issue, which allows sensitive information to be stored in plain text in the database. To mitigate this risk, users should upgrade to the latest patched versions. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
silverstripe/framework is an open-source PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers.
The vulnerability allows sensitive data, such as mistyped passwords, to be stored in plain text in the database. This can potentially expose user passwords and other sensitive information.
Versions 3.5.0-rc1 to 3.5.6, 3.6.0-rc1 to 3.6.3, and 4.0.0-rc1 to 4.0.1 of silverstripe/framework are affected by this vulnerability.
To fix this vulnerability, upgrade to the latest patched versions of silverstripe/framework: 3.5.6, 3.6.3, or 4.0.1.
There is no specific workaround for this vulnerability. Upgrading to the patched versions is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
