Every CVESearch/Get API key

GHSA-g4hp-pfvf-vm5w

SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation

6.5 MediumFix available

When a secure token parameter is provided to a SilverStripe site (such as isDev or flush) an empty token parameter can be provided in order to bypass normal authentication parameters.

For instance, http://www.mysite.com/?isDev=1&isDevtoken will force a site to dev mode. Alternatively, "flush" could also be used in succession to cause excessive load on a victim site and risk denial of service.

The fix in this case is to ensure that empty tokens fail the validation check.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

What each source reports

GitHub Advisories Score used6.5

SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation

When a secure token parameter is provided to a SilverStripe site (such as isDev or flush) an empty token parameter can be provided in order to bypass normal authentication parameters.

For instance, http://www.mysite.com/?isDev=1&isDevtoken will force a site to dev mode. Alternatively, "flush" could also be used in succession to cause excessive load on a victim site and risk denial of service.

The fix in this case is to ensure that empty tokens fail the validation check.

Record
GHSA-g4hp-pfvf-vm5w
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-639
Updated
2026-11-02
OSV6.5

SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation

When a secure token parameter is provided to a SilverStripe site (such as isDev or flush) an empty token parameter can be provided in order to bypass normal authentication parameters.

For instance, http://www.mysite.com/?isDev=1&isDevtoken will force a site to dev mode. Alternatively, "flush" could also be used in succession to cause excessive load on a victim site and risk denial of service.

The fix in this case is to ensure that empty tokens fail the validation check.

Record
GHSA-g4hp-pfvf-vm5w
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-639
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
silverstripe/framework
Packagist
3.0.0 to 3.0.13
3.0.14
silverstripe/framework
Packagist
3.1.0 up to 3.1.13
3.1.13
silverstripe/framework
Packagist
3.0.0 up to 3.0.14, plus listed versions
3.0.103.0.10-rc13.0.113.0.11-rc13.0.12
Show 15 moreShow less
3.0.133.0.2.13.0.33.0.3-rc13.0.3-rc23.0.43.0.53.0.63.0.6-rc13.0.6-rc23.0.73.0.7-rc13.0.83.0.93.0.9-rc1
3.0.14
silverstripe/framework
Packagist
3.1.0 up to 3.1.13, plus listed versions
3.1.13.1.103.1.10-rc13.1.10-rc23.1.11
Show 21 moreShow less
3.1.11-rc13.1.123.1.13-rc13.1.23.1.2-rc13.1.33.1.3-rc13.1.3-rc23.1.43.1.4-rc13.1.53.1.5-rc13.1.63.1.6-rc13.1.6-rc23.1.6-rc33.1.73.1.7-rc13.1.83.1.93.1.9-rc1
3.1.13

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-g4hp-pfvf-vm5w is a medium vulnerability (CVSS 6.5) in silverstripe/framework, published May 23, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.0.14.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open