GHSA-f3wp-xpv2-6vmg
silverstripe/framework password encryption salt not updated
When a user changes their password, the internal salt used for hashing their password is not updated.
Although this is not considered a security vulnerability, this behaviour has been improved to ensure the salt is reset on change of password.
What each source reports
GitHub AdvisoriesNo score
silverstripe/framework password encryption salt not updated
When a user changes their password, the internal salt used for hashing their password is not updated.
Although this is not considered a security vulnerability, this behaviour has been improved to ensure the salt is reset on change of password.
- Record
GHSA-f3wp-xpv2-6vmg- Updated
- 2026-11-02
OSVNo score
silverstripe/framework password encryption salt not updated
When a user changes their password, the internal salt used for hashing their password is not updated.
Although this is not considered a security vulnerability, this behaviour has been improved to ensure the salt is reset on change of password.
- Record
GHSA-f3wp-xpv2-6vmg- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | 3.1.19-rc1 up to 3.1.20 | 3.1.20 |
silverstripe/frameworkPackagist | 3.2.4-rc1 up to 3.2.5 | 3.2.5 |
silverstripe/frameworkPackagist | 3.3.2-rc1 up to 3.3.3 | 3.3.3 |
silverstripe/frameworkPackagist | 3.4.0-rc1 up to 3.4.1 | 3.4.1 |
silverstripe/frameworkPackagist | 3.1.19-rc1 up to 3.1.20, plus listed versions 3.1.193.1.20-rc13.1.20-rc2 | 3.1.20 |
silverstripe/frameworkPackagist | 3.2.4-rc1 up to 3.2.5, plus listed versions 3.2.43.2.5-rc13.2.5-rc2 | 3.2.5 |
silverstripe/frameworkPackagist | 3.3.2-rc1 up to 3.3.3, plus listed versions 3.3.23.3.3-rc13.3.3-rc2 | 3.3.3 |
silverstripe/frameworkPackagist | 3.4.0-rc1 up to 3.4.1, plus listed versions 3.4.03.4.1-rc13.4.1-rc2 | 3.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-f3wp-xpv2-6vmg is a vulnerability with no CVSS score yet in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.1.20.
References
github.com/silverstripe/silverstripe-framework/commit/08384bb4d6b98c44388ffb4727c317ed14fe3c81
silverstripe.org/download/security-releases/ss-2016-008