silverstripe/framework member disclosure in login form
There is a user ID enumeration vulnerability in our brute force error messages.
- Users that don't exist in will never get a locked out message
- Users that do exist, will get a locked out message
This means an attacker can infer or confirm user details that exist in the member table.
This issue has been resolved by ensuring that login attempt logging and lockout process works equivalently for non-existent users as it does for existant users.
| Software | From | Fixed in |
|---|---|---|
silverstripe / framework
|
3.4.0-rc1 | 3.4.6 |
|
silverstripe / framework
|
3.5.0-rc1 | 3.5.4 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime