Описание
Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a GridField using the GridFieldAddExistingAutocompleter component, the record's title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue.
Ссылки
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 4.13.39 (исключая)Версия от 5.0.0 (включая) до 5.1.11 (исключая)
Одно из
cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:*
cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:*
EPSS
Процентиль: 45%
0.00226
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-200
CWE-732
Связанные уязвимости
CVSS3: 4.3
github
около 2 лет назад
Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter
EPSS
Процентиль: 45%
0.00226
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-200
CWE-732