Every CVESearch/Get API key

GHSA-4qx8-j9vh-2628

silverstripe/framework's User-Agent header not correctly invalidating user session

7.5 HighFix available

GHSA-4qx8-j9vh-2628 is a high vulnerability (CVSS 7.5) in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.5.6.

What does this mean?
Severity
7.5 HighCVSS 3.1, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
3.5.6silverstripe/framework +3 more

Description

A security protection device in Session designed to protect session hijacking was not correctly functioning. This function intended to protect user sessions by detecting changes in the User-Agent header, but modifications to this header were not correctly invalidating the user session.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Affected packages

Affected packages
PackageAffectedFixed
silverstripe/framework
Packagist
3.5.0-rc1 up to 3.5.6
3.5.6
silverstripe/framework
Packagist
3.6.0-rc1 up to 3.6.3
3.6.3
silverstripe/framework
Packagist
3.5.0-rc1 up to 3.5.6, plus listed versions
3.5.03.5.0-rc23.5.0-rc33.5.13.5.1-rc1
Show 11 moreShow less
3.5.1-rc23.5.23.5.2-rc13.5.33.5.3-rc13.5.43.5.4-rc13.5.53.5.5-beta13.5.5-beta23.5.6-rc1
3.5.6
silverstripe/framework
Packagist
3.6.0-rc1 up to 3.6.3, plus listed versions
3.6.03.6.13.6.1-alpha23.6.23.6.2-beta13.6.2-beta23.6.3-rc2
3.6.3

What each source reports

GitHub Advisories Score used7.5

silverstripe/framework's User-Agent header not correctly invalidating user session

A security protection device in Session designed to protect session hijacking was not correctly functioning. This function intended to protect user sessions by detecting changes in the User-Agent header, but modifications to this header were not correctly invalidating the user session.

Record
GHSA-4qx8-j9vh-2628
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-384
Updated
2026-11-02
OSV7.5

silverstripe/framework's User-Agent header not correctly invalidating user session

A security protection device in Session designed to protect session hijacking was not correctly functioning. This function intended to protect user sessions by detecting changes in the User-Agent header, but modifications to this header were not correctly invalidating the user session.

Record
GHSA-4qx8-j9vh-2628
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-384
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open