MEDIUM5.3

GHSA-fwhr-g5r4-xgxf

Silverstripe CMS User Enumeration

Quick fix

GHSA-fwhr-g5r4-xgxf — silverstripe/cms: upgrade to the fixed version with the command below.

composer require silverstripe/cms:^3.5.5

Details

Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/silverstripe/cms

Introduced in: 0Fixed in: 3.5.5

Fixcomposer require silverstripe/cms:^3.5.5

Packagist/silverstripe/cms

Introduced in: 3.6Fixed in: 3.6.1

Fixcomposer require silverstripe/cms:^3.6.1

References

https://nvd.nist.gov/vuln/detail/CVE-2017-12849[ADVISORY]
https://www.silverstripe.org/download/security-releases/ss-2017-005[WEB]