GitHub Advisoryadvisory · Packagist

GHSA-wvfw-w3x6-g526 Silverstripe Framework SQLi Vulnerability

CRITICAL Published 2022-05-14 Modified 2023-09-28 Official page ↗
Aliases
CVE-2019-5715
Ecosystem
Packagist
Packages
silverstripe/framework
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2023-07-19

Affected packages

• Packagist silverstripe/framework: >= 3.0.0, < 3.6.7 → fixed in 3.6.7 • Packagist silverstripe/framework: >= 4.0.0, < 4.0.7 → fixed in 4.0.7 • Packagist silverstripe/framework: >= 3.7.0, < 3.7.3 → fixed in 3.7.3 • Packagist silverstripe/framework: >= 4.1.0, < 4.1.5 → fixed in 4.1.5 • Packagist silverstripe/framework: >= 4.2.0, < 4.2.4 → fixed in 4.2.4 • Packagist silverstripe/framework: >= 4.3.0, < 4.3.1 → fixed in 4.3.1

Description

All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows Reflected SQL Injection through Form and DataObject.

Related

Alias · CVE (1)

  • CVE-2019-5715 All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References