GHSA-vh7q-j8p5-2h4h
silverstripe/framework sends passwords back to browsers under some circumstances
GHSA-vh7q-j8p5-2h4h is a low vulnerability (CVSS 3.5) in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.7.0.
- Severity
- 3.5 LowCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.7.0silverstripe/framework +5 more
Description
Under some circumstances a form may populate a PasswordField with submitted data, reflecting submitted data back to a user. The user will only see their own submissions for password data, which is not considered best practice. We are not aware of data leaks to other users, devices or sessions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | 3.5.5-rc1 up to 3.7.0 | 3.7.0 |
silverstripe/frameworkPackagist | 4.0.3-rc1 up to 4.0.4 | 4.0.4 |
silverstripe/frameworkPackagist | 4.1.0-rc1 up to 4.1.1 | 4.1.1 |
silverstripe/frameworkPackagist | 3.5.5-rc1 up to 3.7.0, plus listed versions 3.5.53.5.63.5.6-rc13.5.73.5.8 Show 18 moreShow less3.5.8-rc13.6.03.6.0-beta13.6.0-beta23.6.0-rc13.6.13.6.1-alpha23.6.23.6.2-beta13.6.2-beta23.6.33.6.3-rc23.6.43.6.53.6.63.6.6-rc13.6.73.6.8 | 3.7.0 |
silverstripe/frameworkPackagist | 4.0.3-rc1 up to 4.0.4, plus listed versions 4.0.3 | 4.0.4 |
silverstripe/frameworkPackagist | 4.1.0-rc1 up to 4.1.1, plus listed versions 4.1.04.1.0-rc2 | 4.1.1 |
What each source reports
GitHub Advisories Score used
silverstripe/framework sends passwords back to browsers under some circumstances
Under some circumstances a form may populate a PasswordField with submitted data, reflecting submitted data back to a user. The user will only see their own submissions for password data, which is not considered best practice. We are not aware of data leaks to other users, devices or sessions.
- Record
GHSA-vh7q-j8p5-2h4h- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSV
silverstripe/framework sends passwords back to browsers under some circumstances
Under some circumstances a form may populate a PasswordField with submitted data, reflecting submitted data back to a user. The user will only see their own submissions for password data, which is not considered best practice. We are not aware of data leaks to other users, devices or sessions.
- Record
GHSA-vh7q-j8p5-2h4h- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/silverstripe/silverstripe-framework/commit/c28f411abd4837cdd9dbf87c4457976e678131cb
silverstripe.org/download/security-releases/ss-2018-013