GHSA-m2hh-2m46-x6j5
Suggest an improvement- Source
- https://github.com/advisories/GHSA-m2hh-2m46-x6j5
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-m2hh-2m46-x6j5/GHSA-m2hh-2m46-x6j5.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-m2hh-2m46-x6j5
- Published
- 2024-05-28T12:53:45Z
- Modified
- 2024-12-03T06:07:52.955783Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- silverstripe/framework may disclose database credentials during connection failure
- Details
-
When running SilverStripe 3.7 or 4.x in dev mode with the mysqli database driver, there is a potential to disclose the connection details.
We have blacklisted the sensitive parts of the connection information from being included in dev mode stack traces when database errors occur.
- Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-209" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-05-28T12:53:45Z" }- References
-
- https://github.com/silverstripe/silverstripe-framework/commit/214e28127f5425b61c15b69f884afdbad31133c2
- https://github.com/silverstripe/silverstripe-framework/commit/54251952387394d72b221e797a80edfbf9a973ee
- https://github.com/silverstripe/silverstripe-framework/commit/9aabe0a0f7a061d87cc92923f8811e14d7a032f5
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-018-1.yaml
- https://github.com/silverstripe/silverstripe-framework
- https://www.silverstripe.org/download/security-releases/ss-2018-018
Affected packages
Packagist / silverstripe/framework
Package
- Name
- silverstripe/framework
- Purl
- pkg:composer/silverstripe/framework
Packagist / silverstripe/framework
Package
- Name
- silverstripe/framework
- Purl
- pkg:composer/silverstripe/framework
Packagist / silverstripe/framework
Package
- Name
- silverstripe/framework
- Purl
- pkg:composer/silverstripe/framework
Packagist / silverstripe/framework
Package
- Name
- silverstripe/framework
- Purl
- pkg:composer/silverstripe/framework