GHSA-256q-hx8w-xcqx
Silverstripe Framework user enumeration via timing attack on login and password reset forms
GHSA-256q-hx8w-xcqx is a medium vulnerability (CVSS 5.3) in silverstripe/framework, published April 10, 2025. No source lists public exploit code. Fixed in silverstripe/framework 5.3.23.
- Severity
- 5.3 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.3.23silverstripe/framework +1 more
Description
Impact
User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.
This was originally disclosed in https://www.silverstripe.org/download/security-releases/ss-2017-005/ for CMS 3 but was not patched in CMS 4+
References
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | 4.0.0 up to 5.3.23 | 5.3.23 |
silverstripe/frameworkPackagist | 4.0.0 up to 5.3.23, plus listed versions 4.0.14.0.1-rc14.0.24.0.34.0.4 Show 45 moreShow less4.0.54.0.64.0.74.1.04.1.0-rc14.1.0-rc24.1.14.1.24.1.34.1.44.1.54.10.04.10.0-beta14.10.0-rc14.10.14.10.104.10.114.10.24.10.34.10.44.10.54.10.64.10.74.10.84.10.94.11.04.11.0-beta14.11.0-beta24.11.0-beta34.11.0-rc14.11.14.11.104.11.114.11.124.11.134.11.144.11.154.11.164.11.24.11.34.11.44.11.54.11.64.11.74.11.8 | 5.3.23 |
What each source reports
GitHub Advisories Score used
Silverstripe Framework user enumeration via timing attack on login and password reset forms
Impact
User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.
This was originally disclosed in https://www.silverstripe.org/download/security-releases/ss-2017-005/ for CMS 3 but was not patched in CMS 4+
References
- Record
GHSA-256q-hx8w-xcqx- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-204
- Updated
- 2026-11-02
OSV
Silverstripe Framework user enumeration via timing attack on login and password reset forms
Impact
User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.
This was originally disclosed in https://www.silverstripe.org/download/security-releases/ss-2017-005/ for CMS 3 but was not patched in CMS 4+
References
- Record
GHSA-256q-hx8w-xcqx- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-204
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-256q-hx8w-xcqx
nvd.nist.gov/vuln/detail/CVE-2017-12849
silverstripe.org/download/security-releases/ss-2017-005
Left out here: 218 versions. The JSON record has them.