GHSA-f3wp-xpv2-6vmg

silverstripe/framework password encryption salt not updated

Low Packagist

Severity: Low; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 3.1.20; Upgrade silverstripe/framework to this version or later

Description

When a user changes their password, the internal salt used for hashing their password is not updated.

Although this is not considered a security vulnerability, this behaviour has been improved to ensure the salt is reset on change of password.

Affected versions

Packagist

Package	Vulnerable	Fixed in
silverstripe/framework	`>= 3.1.19-rc1, < 3.1.20`	`3.1.20`
silverstripe/framework	`>= 3.2.4-rc1, < 3.2.5`	`3.2.5`
silverstripe/framework	`>= 3.3.2-rc1, < 3.3.3`	`3.3.3`
silverstripe/framework	`>= 3.4.0-rc1, < 3.4.1`	`3.4.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

silverstripe/framework Packagist → `3.1.20`

composer

composer require silverstripe/framework:^3.1.20

References

Packages

github.com/silverstripe/silverstripe-framework

Timeline

May 27, 2024 Published
Dec 2, 2024 Last updated by the source

Advisory	Severity	Why it's related
GHSA-gvrw-qqp5-jgc5 Silverstripe Framework: Possible XSS attack through media embed	Medium	Also affects silverstripe/framework
GHSA-256q-hx8w-xcqx Silverstripe Framework user enumeration via timing attack on login and password reset forms	Medium	Also affects silverstripe/framework
GHSA-rhx4-hvx9-j387 Silverstripe Framework has a XSS vulnerability in HTML editor	Medium	Also affects silverstripe/framework
GHSA-74j9-xhqr-6qv3 Reflected Cross Site Scripting (XSS) in error message	Low	Also affects silverstripe/framework
GHSA-mqf3-qpc3-g26q Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message	Low	Also affects silverstripe/framework
GHSA-ff6q-3c9c-6cf5 Silverstripe Framework has a XSS in form messages	Medium	Also affects silverstripe/framework
GHSA-7cmp-cgg8-4c82 Silverstripe Framework has a XSS via insert media remote file oembed	Medium	Also affects silverstripe/framework
GHSA-52cw-pvq9-9m5v Silverstripe uses TinyMCE which allows svg files linked in object tags	Medium	Also affects silverstripe/framework

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor