CVE-2017-12849

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-12849
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12849.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-12849
Aliases
Published
2017-10-12T15:29:00.310Z
Modified
2026-07-08T11:47:50.271334Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.

References

Affected packages

Git
github.com/silverstripe/silverstripe-cms

Affected ranges

Type
GIT
Repo
https://github.com/silverstripe/silverstripe-cms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
11e2175ec86024ba48f595c484cce4fbc30ce8c7
Introduced
08093ea308c13f1f334a01b46d66b720bd86216e
Last affected
08093ea308c13f1f334a01b46d66b720bd86216e
Database specific 
{
    "cpe": [
        "cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:silverstripe:silverstripe:3.6.0:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.5.4"
        },
        {
            "introduced": "3.6.0"
        },
        {
            "last_affected": "3.6.0"
        }
    ]
}

Affected versions

2.*
2.2.0-rc1
2.2.2-rc1
2.3.0-rc1
3.*
3.0.0-alpha1
3.0.0-alpha2
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-pr1
3.0.0-rc1
3.5.0-rc1
3.5.0-rc2
3.5.2
3.5.2-rc1
3.5.3-rc1
3.5.4
3.5.4-rc1
3.6.0
Other
HamishsTesta2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12849.json"
github.com/silverstripe/silverstripe-framework

Affected ranges

Type
GIT
Repo
https://github.com/silverstripe/silverstripe-framework
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2f7f761a9c94c3aed5a2616a2530b233d942e9c3
Introduced
143c4a63cf1f7cf5697abbe31908e446ed2ecb3e
Last affected
143c4a63cf1f7cf5697abbe31908e446ed2ecb3e
Database specific 
{
    "cpe": [
        "cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:silverstripe:silverstripe:3.6.0:*:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.5.4"
        },
        {
            "introduced": "3.6.0"
        },
        {
            "last_affected": "3.6.0"
        }
    ]
}

Affected versions

2.*
2.2.0-rc1
2.2.2-rc1
2.3.0-rc1
3.*
3.0.0-alpha1
3.0.0-alpha2
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-rc1
3.5.0-rc1
3.5.0-rc2
3.5.2-rc1
3.5.3-rc1
3.5.4
3.5.4-rc1
3.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12849.json"