Every CVESearch/Get API key

GHSA-55qg-6c4m-mw6g

silverstripe/framework's URL parameters `isDev` and `isTest` unguarded

6.5 MediumFix available

GHSA-55qg-6c4m-mw6g is a medium vulnerability (CVSS 6.5) in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 4.0.4.

What does this mean?
Severity
6.5 MediumCVSS 3.1, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
4.0.4silverstripe/framework +3 more

Description

The URL parameters isDev and isTest are accessible to unauthenticated users who access a SilverStripe website or application. This allows unauthorised users to expose information that is usually hidden on production environments such as verbose errors (including backtraces) and other debugging tools only available to sites running in "dev mode". Core functionality does not expose user data through these methods. Depending on your website configuration, community modules might have added more specific functionality which can be used to either access or alter user data.

We have fixed the usage of isDev and isTest in SilverStripe 4.x, and removed the URL parameters in the next major release of SilverStripe.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Affected packages

Affected packages
PackageAffectedFixed
silverstripe/framework
Packagist
4.0.0-rc1 up to 4.0.4
4.0.4
silverstripe/framework
Packagist
4.1.0rc1 up to 4.1.1
4.1.1
silverstripe/framework
Packagist
4.0.0-rc1 up to 4.0.4, plus listed versions
4.0.04.0.0-rc24.0.0-rc34.0.14.0.1-rc14.0.24.0.3
4.0.4
silverstripe/framework
Packagist
4.1.0rc1 up to 4.1.1, plus listed versions
4.1.04.1.0-rc14.1.0-rc2
4.1.1

What each source reports

GitHub Advisories Score used6.5

silverstripe/framework's URL parameters `isDev` and `isTest` unguarded

The URL parameters isDev and isTest are accessible to unauthenticated users who access a SilverStripe website or application. This allows unauthorised users to expose information that is usually hidden on production environments such as verbose errors (including backtraces) and other debugging tools only available to sites running in "dev mode". Core functionality does not expose user data through these methods. Depending on your website configuration, community modules might have added more specific functionality which can be used to either access or alter user data.

We have fixed the usage of isDev and isTest in SilverStripe 4.x, and removed the URL parameters in the next major release of SilverStripe.

Record
GHSA-55qg-6c4m-mw6g
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV6.5

silverstripe/framework's URL parameters `isDev` and `isTest` unguarded

The URL parameters isDev and isTest are accessible to unauthenticated users who access a SilverStripe website or application. This allows unauthorised users to expose information that is usually hidden on production environments such as verbose errors (including backtraces) and other debugging tools only available to sites running in "dev mode". Core functionality does not expose user data through these methods. Depending on your website configuration, community modules might have added more specific functionality which can be used to either access or alter user data.

We have fixed the usage of isDev and isTest in SilverStripe 4.x, and removed the URL parameters in the next major release of SilverStripe.

Record
GHSA-55qg-6c4m-mw6g
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open