GHSA-5r8w-66hq-rc39
silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled
GHSA-5r8w-66hq-rc39 is a low vulnerability (CVSS 3.1) in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.1.20.
- Severity
- 3.1 LowCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.1.20silverstripe/framework +7 more
Description
If remember me is on and users log in with the box checked, if the developer then disabled "remember me" function, any pre-existing cookies will continue to authenticate users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | 3.1.19-rc1 up to 3.1.20 | 3.1.20 |
silverstripe/frameworkPackagist | 3.2.4-rc1 up to 3.2.5 | 3.2.5 |
silverstripe/frameworkPackagist | 3.3.2-rc1 up to 3.3.3 | 3.3.3 |
silverstripe/frameworkPackagist | 3.4.0-rc1 up to 3.4.1 | 3.4.1 |
silverstripe/frameworkPackagist | 3.1.19-rc1 up to 3.1.20, plus listed versions 3.1.193.1.20-rc13.1.20-rc2 | 3.1.20 |
silverstripe/frameworkPackagist | 3.2.4-rc1 up to 3.2.5, plus listed versions 3.2.43.2.5-rc13.2.5-rc2 | 3.2.5 |
silverstripe/frameworkPackagist | 3.3.2-rc1 up to 3.3.3, plus listed versions 3.3.23.3.3-rc13.3.3-rc2 | 3.3.3 |
silverstripe/frameworkPackagist | 3.4.0-rc1 up to 3.4.1, plus listed versions 3.4.03.4.1-rc13.4.1-rc2 | 3.4.1 |
What each source reports
GitHub Advisories Score used
silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled
If remember me is on and users log in with the box checked, if the developer then disabled "remember me" function, any pre-existing cookies will continue to authenticate users.
- Record
GHSA-5r8w-66hq-rc39- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-613
- Updated
- 2026-11-02
OSV
silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled
If remember me is on and users log in with the box checked, if the developer then disabled "remember me" function, any pre-existing cookies will continue to authenticate users.
- Record
GHSA-5r8w-66hq-rc39- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-613
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/silverstripe/silverstripe-framework/commit/1c7d5de51bcdf16ebb21c5a0ebe5fe9e31f9a822
silverstripe.org/download/security-releases/ss-2016-014