Silverstripe Brute force bypass on default admin

2024-05-2319:37:11

CWE-307

GitHub Advisory Database

github.com

silverstripe

brute force

bypass

default admin

software

unlimited attempts

7.2 High

AI Score

Confidence

Low

JSON

Default Administrator accounts were not subject to the same brute force protection afforded to other Member accounts. Failed login counts were not logged for default admins resulting in unlimited attempts on the default admin username and password.

Affected configurations

Vulners

Node

silverstripeframeworkRange<3.3.2

silverstripeframeworkRange<3.2.4

silverstripeframeworkRange<3.1.19

CPENameOperatorVersion
silverstripe/frameworklt3.3.2
silverstripe/frameworklt3.2.4
silverstripe/frameworklt3.1.19

Name	Operator	Version
silverstripe/framework	lt	3.3.2
silverstripe/framework	lt	3.2.4
silverstripe/framework	lt	3.1.19

References

github.com/advisories/GHSA-8v6m-7f5v-hhx6

github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-005-1.yaml

github.com/silverstripe/silverstripe-framework/commit/f32c893546340c8c279fd1ab6d4269e9d6539bc2

www.silverstripe.org/download/security-releases/ss-2016-005

7.2 High

AI Score

Confidence

Low

JSON