GitHub Advisoryadvisory · Packagist

GHSA-fwhr-g5r4-xgxf Silverstripe CMS User Enumeration

MEDIUM Published 2022-05-17 Modified 2023-07-26 Official page ↗
Aliases
CVE-2017-12849
Ecosystem
Packagist
Packages
silverstripe/cms
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-07-26

Affected packages

• Packagist silverstripe/cms: < 3.5.5 → fixed in 3.5.5 • Packagist silverstripe/cms: >= 3.6, < 3.6.1 → fixed in 3.6.1

Description

Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.

Related

Alias · CVE (1)

  • CVE-2017-12849 Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References