GitHub Advisoryadvisory · Packagist

GHSA-cg8j-8w52-735v Missing warning can lead to unauthenticated admin access in SilverStripe

CRITICAL Published 2019-11-12 Modified 2024-02-05 Official page ↗
Aliases
CVE-2019-12204
Ecosystem
Packagist
Packages
silverstripe/cms, silverstripe/framework
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reviewed
2019-10-01

Affected packages

• Packagist silverstripe/cms: >= 4.4.0, < 4.4.4 → fixed in 4.4.4 • Packagist silverstripe/framework: >= 4.1.0, < 4.3.5 → fixed in 4.3.5

Description

In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.

Related

Alias · CVE (1)

  • CVE-2019-12204 In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access. vulnerability

References