Silverstripe Framework: Members with no password can be created and bypass custom login forms

🗓️ 31 Jul 2023 22:00:58Reported by GitHub Advisory DatabaseType

Silverstripe Framework: Blank password security issue fixed, how to detect and handle empty password

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2023-32302	1 Aug 202315:20	–	circl
CNNVD	Number withdrawn	1 Aug 202300:00	–	cnnvd
CVE	CVE-2023-32302	1 Aug 202310:44	–	cve
Cvelist	CVE-2023-32302	1 Aug 202310:44	–	cvelist
EUVD	EUVD-2023-1935	3 Oct 202520:07	–	euvd
Friends Of PHP	CVE-2023-32302 - Members with no password can be created and bypass custom login forms	30 Jul 202323:39	–	friendsofphp
NVD	CVE-2023-32302	1 Aug 202311:15	–	nvd
OSV	GHSA-36XX-7VF6-7MV3 Silverstripe Framework: Members with no password can be created and bypass custom login forms	31 Jul 202322:00	–	osv
Prion	Design/Logic Flaw	1 Aug 202311:15	–	prion
Positive Technologies	PT-2023-23713 · Silverstripe · Silverstripe/Framework	31 Jul 202300:00	–	ptsecurity

Vulners

Node

silverstripe frameworkRange3.0.0–4.13.14composer

silverstripe frameworkRange5.0.0–5.0.13composer

Source	Link
github	www.github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-36xx-7vf6-7mv3
github	www.github.com/silverstripe/silverstripe-framework/commit/7b21b38ac4532d06565dfcefad50540ebd2b50f4
github	www.github.com/silverstripe/silverstripe-framework/releases/tag/4.13.14
github	www.github.com/silverstripe/silverstripe-framework/releases/tag/5.0.13
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-32302
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2023-32302.yaml
silverstripe	www.silverstripe.org/download/security-releases/CVE-2023-32302
github	www.github.com/github/advisory-database/pull/2575
github	www.github.com/advisories/GHSA-36xx-7vf6-7mv3

08 Nov 2023 05:01Current

8High risk

Vulners AI Score8