Unscored CVE-2013-6789 EUVD-2013-6591GHSA-h55h-wq7v-r6qm

security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local attackers to obtain …

Published Nov 13, 2013 · Updated Sep 17, 2024 · Assigned by mitre

Description

security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history, a similar vulnerability to CVE-2013-2653.

References

https://github.com/chillu/silverstripe-framework/commit/3e88c98ca513880e2b43ed7f27ade17fef5d9170
20130801 SilverStripe(R) Information Exposure Through Query Strings in GET Request (CWE-598) mailing-list