GHSA-8v6m-7f5v-hhx6: Silverstripe Brute force bypass on default admin
Default Administrator accounts were not subject to the same brute force protection afforded to other Member accounts. Failed login counts were not logged for default admins resulting in unlimited attempts on the default admin username and password.
Published May 23, 2024
Affected packages
silverstripe/framework
- Ecosystem
- Composer (PHP)
- Affected
- >= 3.1.18, < 3.1.19
- Fixed in
- 3.1.19
- Check
composer show silverstripe/framework
silverstripe/framework
- Ecosystem
- Composer (PHP)
- Affected
- >= 3.2.3, < 3.2.4
- Fixed in
- 3.2.4
- Check
composer show silverstripe/framework
silverstripe/framework
- Ecosystem
- Composer (PHP)
- Affected
- >= 3.3.1, < 3.3.2
- Fixed in
- 3.3.2
- Check
composer show silverstripe/framework
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Default Administrator accounts were not subject to the same brute force protection afforded to other Member accounts. Failed login counts were not logged for default admins resulting in unlimited attempts on the default admin username and password.
References
- https://github.com/silverstripe/silverstripe-framework/commit/f32c893546340c8c279fd1ab6d4269e9d6539bc2
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-005-1.yaml
- https://www.silverstripe.org/download/security-releases/ss-2016-005
- https://github.com/advisories/GHSA-8v6m-7f5v-hhx6
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology