CVE-2023-48714: Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user…

PriorityP421medium4.3CVSS 3.1

AVNACLPRLUINSUCLINAN

EPSS

0.36%

27.4th percentile

Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAddExistingAutocompleter` component, the record's title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
silverstripe	framework	< 4.13.39	4.13.39
silverstripe	framework	>= 0 < 4.13.39	4.13.39
silverstripe	framework	>= 5.0.0 < 5.1.11	5.1.11
silverstripe	framework	>= 5.0.0 < 5.1.11	5.1.11
silverstripe	silverstripe-framework	< 4.13.39	4.13.39
silverstripe	silverstripe-framework	—	—

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

ghsa4.3MEDIUM

osv4.3MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.