GHSA-vp8p-c6xj-xpj7
Silverstripe External redirection risk in Security?ReturnURL
A vulnerability has been found in the SilverStripe framework where a login url can be potentially redirected to an external site.
For example, the url http://www.my-silverstripe-site.com/Security/login?BackURL=/\attacker-site.com will redirect successful logins to the page http://attacker-site.com. If that website were set up to look identical to the first with "login failed" then the user will likely just enter their user/pass again.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Silverstripe External redirection risk in Security?ReturnURL
A vulnerability has been found in the SilverStripe framework where a login url can be potentially redirected to an external site.
For example, the url http://www.my-silverstripe-site.com/Security/login?BackURL=/\attacker-site.com will redirect successful logins to the page http://attacker-site.com. If that website were set up to look identical to the first with "login failed" then the user will likely just enter their user/pass again.
- Record
GHSA-vp8p-c6xj-xpj7- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Silverstripe External redirection risk in Security?ReturnURL
A vulnerability has been found in the SilverStripe framework where a login url can be potentially redirected to an external site.
For example, the url http://www.my-silverstripe-site.com/Security/login?BackURL=/\attacker-site.com will redirect successful logins to the page http://attacker-site.com. If that website were set up to look identical to the first with "login failed" then the user will likely just enter their user/pass again.
- Record
GHSA-vp8p-c6xj-xpj7- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | through 3.0.13 | 3.0.14 |
silverstripe/frameworkPackagist | 3.1.0 to 3.1.13-rc1 | 3.1.13 |
silverstripe/frameworkPackagist | before 3.0.14, plus listed versions 2.4.102.4.112.4.122.4.132.4.9 Show 21 moreShow less2.5.03.0.103.0.10-rc13.0.113.0.11-rc13.0.123.0.133.0.2.13.0.33.0.3-rc13.0.3-rc23.0.43.0.53.0.63.0.6-rc13.0.6-rc23.0.73.0.7-rc13.0.83.0.93.0.9-rc1 | 3.0.14 |
silverstripe/frameworkPackagist | 3.1.0 up to 3.1.13, plus listed versions 3.1.13.1.103.1.10-rc13.1.10-rc23.1.11 Show 21 moreShow less3.1.11-rc13.1.123.1.13-rc13.1.23.1.2-rc13.1.33.1.3-rc13.1.3-rc23.1.43.1.4-rc13.1.53.1.5-rc13.1.63.1.6-rc13.1.6-rc23.1.6-rc33.1.73.1.7-rc13.1.83.1.93.1.9-rc1 | 3.1.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-vp8p-c6xj-xpj7 is a medium vulnerability (CVSS 5.8) in silverstripe/framework, published May 23, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.0.14.
References
github.com/silverstripe/silverstripe-framework/commit/22a35e48a9f513d4caa3b4e9b8dd21c49ffc8f2c
silverstripe.org/software/download/security-releases/ss-2015-012