GHSA-55qg-6c4m-mw6g
Suggest an improvement- Source
- https://github.com/advisories/GHSA-55qg-6c4m-mw6g
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-55qg-6c4m-mw6g/GHSA-55qg-6c4m-mw6g.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-55qg-6c4m-mw6g
- Published
- 2024-05-27T22:02:02Z
- Modified
- 2024-12-02T05:43:35.477342Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- silverstripe/framework's URL parameters `isDev` and `isTest` unguarded
- Details
-
The URL parameters
isDevandisTestare accessible to unauthenticated users who access a SilverStripe website or application. This allows unauthorised users to expose information that is usually hidden on production environments such as verbose errors (including backtraces) and other debugging tools only available to sites running in "dev mode". Core functionality does not expose user data through these methods. Depending on your website configuration, community modules might have added more specific functionality which can be used to either access or alter user data.We have fixed the usage of isDev and isTest in SilverStripe 4.x, and removed the URL parameters in the next major release of SilverStripe.
- Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-200" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-05-27T22:02:02Z" }- References
-
- https://github.com/silverstripe/silverstripe-framework/commit/d935140a9528a3a42323b51d84fb2bcd3da065a7
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-005-1.yaml
- https://github.com/silverstripe/silverstripe-framework
- https://www.silverstripe.org/download/security-releases/ss-2018-005
Affected packages
Packagist / silverstripe/framework
Package
- Name
- silverstripe/framework
- Purl
- pkg:composer/silverstripe/framework
Packagist / silverstripe/framework
Package
- Name
- silverstripe/framework
- Purl
- pkg:composer/silverstripe/framework