GHSA-7m2v-x7rg-5hm5
silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms
User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.
What each source reports
GitHub AdvisoriesNo score
silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms
User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.
- Record
GHSA-7m2v-x7rg-5hm5- Updated
- 2026-11-02
OSVNo score
silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms
User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.
- Record
GHSA-7m2v-x7rg-5hm5- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | 3.5.0-rc1 up to 3.5.5 | 3.5.5 |
silverstripe/frameworkPackagist | 3.6.0-rc1 up to 3.6.2 | 3.6.2 |
silverstripe/frameworkPackagist | 3.5.0-rc1 up to 3.5.5, plus listed versions 3.5.03.5.0-rc23.5.0-rc33.5.13.5.1-rc1 Show 9 moreShow less3.5.1-rc23.5.23.5.2-rc13.5.33.5.3-rc13.5.43.5.4-rc13.5.5-beta13.5.5-beta2 | 3.5.5 |
silverstripe/frameworkPackagist | 3.6.0-rc1 up to 3.6.2, plus listed versions 3.6.03.6.13.6.1-alpha23.6.2-beta13.6.2-beta2 | 3.6.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-7m2v-x7rg-5hm5 is a vulnerability with no CVSS score yet in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.5.5.
References
github.com/silverstripe/silverstripe-framework/commit/f0262a8fd9ab5fb51b178ace3c3487351217f5a0
silverstripe.org/download/security-releases/ss-2017-005