Silverstripe vulnerabilities

CVE-2019-5715 [CRITICAL] CWE-89 CVE-2019-5715: All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows Reflected SQL Injection through Form and DataObject.

CVE-2019-12204 [CRITICAL] CVE-2019-12204: In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can l In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.

CVE-2013-2653 [MEDIUM] CWE-20 CVE-2013-2653: security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes i security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote attackers to conduct phishing attacks without detection by the victim.

CVE-2011-4958 [MEDIUM] CWE-79 CVE-2011-4958: Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe bef Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as demonstrated by a request to (1) admin/reports/, (2) admin/comments/, (3) admin/, (4) admin/show/, (5) admi

CVE-2020-6164 [HIGH] CVE-2020-6164: In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/fr In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to execution in a CLI context, and is not known to present a vulnera

CVE-2020-9280 [HIGH] CWE-434 CVE-2020-9280: In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is installed and enabled by default on the Common Web Platform (

CVE-2011-4960 [HIGH] CWE-89 CVE-2011-4960: SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2010-4824 [MEDIUM] CWE-89 CVE-2010-4824: SQL injection vulnerability in the augmentSQL method in core/model/Translatable.php in SilverStripe SQL injection vulnerability in the augmentSQL method in core/model/Translatable.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when the Translatable extension is enabled, allows remote attackers to execute arbitrary SQL commands via the locale parameter.

CVE-2011-4959 [MEDIUM] CWE-89 CVE-2011-4959: SQL injection vulnerability in the addslashes method in SilverStripe 2.3.x before 2.3.12 and 2.4.x b SQL injection vulnerability in the addslashes method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6, when connected to a MySQL database using far east character encodings, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2020-26136 [MEDIUM] CWE-287 CVE-2020-26136: In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when usi In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.

CVE-2008-6753 [HIGH] CWE-89 CVE-2008-6753: SQL injection vulnerability in SilverStripe before 2.2.2 allows remote attackers to execute arbitrar SQL injection vulnerability in SilverStripe before 2.2.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to AjaxUniqueTextField.

CVE-2011-4962 [MEDIUM] CWE-20 CVE-2011-4962: code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote att code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized.

CVE-2019-12437 [HIGH] CWE-352 CVE-2019-12437: In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the ris In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,

CVE-2009-1433 [HIGH] CWE-89 CVE-2009-1433: SQL injection vulnerability in File::find (filesystem/File.php) in SilverStripe before 2.3.1 allows SQL injection vulnerability in File::find (filesystem/File.php) in SilverStripe before 2.3.1 allows remote attackers to execute arbitrary SQL commands via the filename parameter.

CVE-2022-24444 [MEDIUM] CWE-384 CVE-2022-24444: Silverstripe silverstripe/framework through 4.10 allows Session Fixation. Silverstripe silverstripe/framework through 4.10 allows Session Fixation.

CVE-2010-5091 [MEDIUM] CWE-94 CVE-2010-5091: The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4. The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file.

CVE-2010-5080 [MEDIUM] CWE-255 CVE-2010-5080: The Security/changepassword URL action in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 pa The Security/changepassword URL action in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 passes a token as a GET parameter while changing a password through email, which allows remote attackers to obtain sensitive data and hijack the session via the HTTP referer logs on a server, aka "HTTP referer leakage."

CVE-2010-5079 [MEDIUM] CWE-310 CVE-2010-5079: SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) autologin, (3) "forgot password" functionality, and (4) password salts, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors.

CVE-2017-12849 [MEDIUM] CWE-200 CVE-2017-12849: Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6. Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.

CVE-2020-6165 [MEDIUM] CWE-276 CVE-2020-6165: SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The automatic permission-checking mechanism in the silverstripe/graphql module does not provide complete protection against lists that are limited (e.g., through pagination), resulting in records that sho