Описание
silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms
When accessing the install.php script it is possible to extract any pre-configured database or default admin account password by viewing the source of the page, and inspecting the value property of the password fields.
Пакеты
Наименование
silverstripe/framework
composer
Затронутые версииВерсия исправления
>= 4.0.0-rc1, < 4.0.1
4.0.1
6.5 Medium
CVSS3
Дефекты
CWE-200
6.5 Medium
CVSS3
Дефекты
CWE-200