silverstripe/framework has possible denial of service attack vector when flushing
High severity
GitHub Reviewed
Published
May 28, 2024
to the GitHub Advisory Database
•
Updated May 28, 2024
Package
Affected versions
>= 4.0.0-rc1, < 4.0.5
>= 4.1.0-rc1, < 4.1.3
>= 4.2.0-rc1, < 4.2.2
Patched versions
4.0.5
4.1.3
4.2.2
Description
Published to the GitHub Advisory Database
May 28, 2024
Reviewed
May 28, 2024
Last updated
May 28, 2024
A possible denial of service attack vector has been identified in the dev/build system controller.
dev/build now has its own URL token, similar to flushtoken, to ensure users are authenticated when running dev/build outside of dev environments.
References