Code injection

2012-08-2618:55:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.4%

JSON

Member_ProfileForm in security/Member.php in SilverStripe 2.3.x before 2.3.7 allows remote attackers to hijack user accounts by saving data using the email address (ID) of another user.

CPENameOperatorVersion
silverstripeeq2.3.4
silverstripeeq2.3.0 rc2
silverstripeeq2.3.1 rc2
silverstripeeq2.3.0 rc3
silverstripeeq2.3.3
silverstripeeq2.3.1
silverstripeeq2.3.1 rc1
silverstripeeq2.3.5
silverstripeeq2.3.6
silverstripeeq2.3.0

Name	Operator	Version
silverstripe	eq	2.3.4
silverstripe	eq	2.3.0 rc2
silverstripe	eq	2.3.1 rc2
silverstripe	eq	2.3.0 rc3
silverstripe	eq	2.3.3
silverstripe	eq	2.3.1
silverstripe	eq	2.3.1 rc1
silverstripe	eq	2.3.5
silverstripe	eq	2.3.6
silverstripe	eq	2.3.0

Rows per page:

1-10 of 121

References

doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.7

open.silverstripe.org/changeset/100744

www.openwall.com/lists/oss-security/2012/04/30/1

www.openwall.com/lists/oss-security/2012/04/30/3

www.openwall.com/lists/oss-security/2012/05/01/3

www.silverstripe.org/security-releases