Skip to content
Log inStart free trial

GHSA-q9ff-3q93-fm8m CVE-2019-19326

SilverStripe Web Cache Poisoning through HTTPRequestBuilder

Medium Packagist
Severity
5.9 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.76%
Chance of exploitation in the next 30 days. Higher than 55.24% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Fix
4.4.7
Upgrade silverstripe/framework to this version or later

Description

SilverStripe through 4.4.4 allows Web Cache Poisoning through HTTPRequestBuilder.

Affected versions

Packagist

PackageVulnerableFixed in
silverstripe/framework
>= 4.0.0, < 4.4.7
4.4.7
silverstripe/framework
>= 4.5.0, < 4.5.4
4.5.4
silverstripe/framework
>= 3.0.0, < 3.7.5
3.7.5

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

silverstripe/framework Packagist → 4.4.7

composer
composer require silverstripe/framework:^4.4.7

Severity breakdown

CVSS 3.1 5.9

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Weakness

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

How to prevent it
  • Implementation: Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
  • Implementation: Use only SSL communication.
  • Implementation: Terminate the client session after each request.
  • System Configuration: Turn all pages to non-cacheable.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-gvrw-qqp5-jgc5
Silverstripe Framework: Possible XSS attack through media embed
Medium Also affects silverstripe/framework
GHSA-256q-hx8w-xcqx
Silverstripe Framework user enumeration via timing attack on login and password reset forms
Medium Also affects silverstripe/framework
GHSA-rhx4-hvx9-j387
Silverstripe Framework has a XSS vulnerability in HTML editor
Medium Also affects silverstripe/framework
GHSA-74j9-xhqr-6qv3
Reflected Cross Site Scripting (XSS) in error message
Low Also affects silverstripe/framework
GHSA-mqf3-qpc3-g26q
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message
Low Also affects silverstripe/framework
GHSA-ff6q-3c9c-6cf5
Silverstripe Framework has a XSS in form messages
Medium Also affects silverstripe/framework
GHSA-7cmp-cgg8-4c82
Silverstripe Framework has a XSS via insert media remote file oembed
Medium Also affects silverstripe/framework
GHSA-52cw-pvq9-9m5v
Silverstripe uses TinyMCE which allows svg files linked in object tags
Medium Also affects silverstripe/framework
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor