SilverStripe Priviledge escalation through cache pollution · CVE-2019-12617 · GitHub Advisory Database · GitHub

SilverStripe Priviledge escalation through cache pollution

Low severity GitHub Reviewed Published Nov 12, 2019 to the GitHub Advisory Database • Updated Feb 5, 2024

Package

silverstripe/framework (Composer)

Affected versions

>= 4.4.0, < 4.4.4

>= 4.3.0, < 4.3.5

Patched versions

4.4.4

4.3.5

Description

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.

References

Reviewed Nov 12, 2019

Published to the GitHub Advisory Database Nov 12, 2019

Last updated Feb 5, 2024

Severity

Low

2.7

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N