Skip to content
OpenAdvisories
Medium · 6.3 CVE-2019-12203 EUVD-2019-0764GHSA-w7r7-r8r9-vrg2

Session fixation in change password form

Published Sep 25, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Package: silverstripe/framework Ecosystem: Packagist

Description

SilverStripe through 4.3.3 allows session fixation in the "change password" form.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist silverstripe/framework >= 3.7.0, < 3.7.4 3.7.4 GHSA-w7r7-r8r9-vrg2
Packagist silverstripe/framework >= 4.4.0, < 4.4.4 4.4.4 GHSA-w7r7-r8r9-vrg2
Packagist silverstripe/framework >= 3.6.0, < 3.6.8 3.6.8 GHSA-w7r7-r8r9-vrg2
Packagist silverstripe/framework >= 4.0.0, < 4.3.5 4.3.5 GHSA-w7r7-r8r9-vrg2

References