Skip to content
Log inStart free trial

GHSA-p5h2-vr99-xm99

silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()`

Medium Packagist
Severity
4.3 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
—
No score published
Known exploited
No
Not in CISA's catalog
Weakness
CWE-287 Improper Authentication
Fix
3.1.20
Upgrade silverstripe/framework to this version or later

Description

After performing a password reset, ChangePasswordForm::doChangePassword() logs in the user without checking Member::canLogIn(). This presents an issue for sites that are using the extension point in that method to deny access to users (for example members that have not been “approved”, or members that have had their access revoked temporarily). It looks like Member::canLogIn() was originally designed to only be used for checking whether the user is locked out (due to too many incorrect login attempts) but has been opened up to other uses.

Affected versions

Packagist

PackageVulnerableFixed in
silverstripe/framework
>= 3.1.19-rc1, < 3.1.20
3.1.20
silverstripe/framework
>= 3.2.4-rc1, < 3.2.5
3.2.5
silverstripe/framework
>= 3.3.2-rc1, < 3.3.3
3.3.3
silverstripe/framework
>= 3.4.0-rc1, < 3.4.1
3.4.1

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

silverstripe/framework Packagist → 3.1.20

composer
composer require silverstripe/framework:^3.1.20

Severity breakdown

CVSS 3.1 4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Weakness

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How to prevent it
  • Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

References

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
AdvisorySeverityWhy it's related
GHSA-gvrw-qqp5-jgc5
Silverstripe Framework: Possible XSS attack through media embed
Medium Also affects silverstripe/framework
GHSA-256q-hx8w-xcqx
Silverstripe Framework user enumeration via timing attack on login and password reset forms
Medium Also affects silverstripe/framework
GHSA-rhx4-hvx9-j387
Silverstripe Framework has a XSS vulnerability in HTML editor
Medium Also affects silverstripe/framework
GHSA-74j9-xhqr-6qv3
Reflected Cross Site Scripting (XSS) in error message
Low Also affects silverstripe/framework
GHSA-mqf3-qpc3-g26q
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message
Low Also affects silverstripe/framework
GHSA-ff6q-3c9c-6cf5
Silverstripe Framework has a XSS in form messages
Medium Also affects silverstripe/framework
GHSA-7cmp-cgg8-4c82
Silverstripe Framework has a XSS via insert media remote file oembed
Medium Also affects silverstripe/framework
GHSA-52cw-pvq9-9m5v
Silverstripe uses TinyMCE which allows svg files linked in object tags
Medium Also affects silverstripe/framework
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor