Information disclosure in Silverstripe Framework
CVE-2023-48714
Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAddExistingAutocompleter` component, the record's title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (26.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 26.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Silverstripe Framework
- Silverstripe Silverstripe-Framework — versions < 4.13.39, >= 5.0.0, < 5.1.11
Weakness classification (CWE)
References
- github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-qm2j-qv… (Vendor Advisory)
- www.silverstripe.org/download/security-releases/CVE-2023-48714 (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-48714?
- CVE-2023-48714 is a medium-severity vulnerability in Silverstripe Framework, classified under Information Disclosure. CVSS score: 4.3/10. Published 2024-01-23.
- How severe is CVE-2023-48714?
- Medium severity. CVSS v3 base score is 4.3 out of 10.