GHSA-r3pr-fh25-wrfc

silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms

6.5 MediumFix available

GHSA-r3pr-fh25-wrfc is a medium vulnerability (CVSS 6.5) in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 4.0.1.

What does this mean?

Severity: 6.5 MediumCVSS 3.1, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 4.0.1silverstripe/framework +1 more

Description

When accessing the install.php script it is possible to extract any pre-configured database or default admin account password by viewing the source of the page, and inspecting the value property of the password fields.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Affected packages

Affected packages
Package	Affected	Fixed
`silverstripe/framework` Packagist	4.0.0-rc1 up to 4.0.1	4.0.1
`silverstripe/framework` Packagist	4.0.0-rc1 up to 4.0.1, plus listed versions 4.0.04.0.0-rc24.0.0-rc34.0.1-rc1	4.0.1

What each source reports

GitHub Advisories Score used6.5

silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms

Record: GHSA-r3pr-fh25-wrfc
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSV6.5