Skip to content
OpenAdvisories
Critical · 9.8 CVE-2019-12204 EUVD-2019-0743GHSA-cg8j-8w52-735v

Missing warning can lead to unauthenticated admin access in SilverStripe

Published Sep 25, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Package: silverstripe/cms Package: silverstripe/framework Ecosystem: Packagist

Description

In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist silverstripe/cms >= 4.4.0, < 4.4.4 4.4.4 GHSA-cg8j-8w52-735v
Packagist silverstripe/framework >= 4.1.0, < 4.3.5 4.3.5 GHSA-cg8j-8w52-735v

References