GHSA-m2hh-2m46-x6j5

Source

https://github.com/advisories/GHSA-m2hh-2m46-x6j5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-m2hh-2m46-x6j5/GHSA-m2hh-2m46-x6j5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m2hh-2m46-x6j5

Published

2024-05-28T12:53:45Z

Modified

2024-12-03T06:07:52Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

silverstripe/framework may disclose database credentials during connection failure

Details

When running SilverStripe 3.7 or 4.x in dev mode with the mysqli database driver, there is a potential to disclose the connection details.

We have blacklisted the sensitive parts of the connection information from being included in dev mode stack traces when database errors occur.

Database specific

{
    "cwe_ids":  [
        "CWE-209"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-05-28T12:53:45Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / silverstripe/framework

Package

Name: silverstripe/framework
Purl: pkg:composer/silverstripe/framework

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.7.0-rc1

Fixed

3.7.1

Affected versions

3.*

3.7.0

3.7.1-rc1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-m2hh-2m46-x6j5/GHSA-m2hh-2m46-x6j5.json"

Packagist / silverstripe/framework

Package

Name: silverstripe/framework
Purl: pkg:composer/silverstripe/framework

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0-rc1

Fixed

4.0.5

Affected versions

4.*

4.0.0-rc1

4.0.0-rc2

4.0.0-rc3

4.0.0

4.0.1-rc1

4.0.1

4.0.2

4.0.3

4.0.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-m2hh-2m46-x6j5/GHSA-m2hh-2m46-x6j5.json"

Packagist / silverstripe/framework

Package

Name: silverstripe/framework
Purl: pkg:composer/silverstripe/framework

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.1.0-rc1

Fixed

4.1.3

Affected versions

4.*

4.1.0-rc1

4.1.0-rc2

4.1.0

4.1.1

4.1.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-m2hh-2m46-x6j5/GHSA-m2hh-2m46-x6j5.json"

Packagist / silverstripe/framework

Package

Name: silverstripe/framework
Purl: pkg:composer/silverstripe/framework

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.2.0-rc1

Fixed

4.2.2

Affected versions

4.*

4.2.0

4.2.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-m2hh-2m46-x6j5/GHSA-m2hh-2m46-x6j5.json"