Vulnerability in silverstripe/framework: Passwords Sent Back to Browsers
Summary
GHSA-vh7q-j8p5-2h4h: silverstripe/framework sends passwords back to browsers under some circumstances. Affects silverstripe/framework across 3 version ranges.
>= 3.5.5-rc1, < 3.7.0
>= 4.0.3-rc1, < 4.0.4
>= 4.1.0-rc1, < 4.1.1
Fixed in 3.7.0, 4.0.4 or 4.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
silverstripe/framework is a PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers, including form handling. However, a vulnerability has been discovered in versions 3.5.5-rc1 to 3.7.0, 4.0.3-rc1 to 4.0.4, and 4.1.0-rc1 to 4.1.1 of the framework. This vulnerability allows passwords to be sent back to browsers under certain circumstances, which is considered a security risk.
Vulnerability Detail
The vulnerability in silverstripe/framework occurs when a form with a PasswordField is submitted. In some cases, the submitted password data is reflected back to the user, potentially exposing sensitive information. While there are no known data leaks to other users, devices, or sessions, this behavior is not considered best practice. The vulnerability has a CVSS score of 3.5, indicating a low severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.5.5-rc1, < 3.7.03.7.0composer require silverstripe/framework:3.7.0 -
>= 4.0.3-rc1, < 4.0.44.0.4composer require silverstripe/framework:4.0.4 -
>= 4.1.0-rc1, < 4.1.14.1.1composer require silverstripe/framework:4.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to follow the fix instructions and upgrade to a fixed version of silverstripe/framework.
Conclusion
In conclusion, the silverstripe/framework package is vulnerable to a security issue where passwords can be sent back to browsers under certain circumstances. It is recommended to upgrade to a fixed version of the framework to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
silverstripe/framework is a PHP framework used for building websites and web applications. It provides developers with a range of features and functionalities to simplify the development process.
The vulnerability occurs when a form with a PasswordField is submitted. Under certain circumstances, the submitted password data is reflected back to the user, potentially exposing sensitive information.
The potential risks of this vulnerability include the exposure of sensitive password data to the user, which can lead to unauthorized access to user accounts.
No, there are no known data leaks to other users, devices, or sessions. However, the behavior of reflecting password data back to the user is still considered a security risk.
The severity level of this vulnerability is low, with a CVSS score of 3.5.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
