Missing warning can lead to unauthenticated admin access in SilverStripe · CVE-2019-12204 · GitHub Advisory Database · GitHub

Missing warning can lead to unauthenticated admin access in SilverStripe

Critical severity GitHub Reviewed Published Nov 12, 2019 to the GitHub Advisory Database • Updated Feb 5, 2024

Package

silverstripe/cms (Composer)

Affected versions

>= 4.4.0, < 4.4.4

Patched versions

4.4.4

silverstripe/framework (Composer)

>= 4.1.0, < 4.3.5

4.3.5

Description

In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.

References

Published by the National Vulnerability Database

Sep 25, 2019

Reviewed Oct 1, 2019

Published to the GitHub Advisory Database Nov 12, 2019

Last updated Feb 5, 2024

Severity

Critical

9.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H