CVE-2023-22728 Silverstripe Framework has missing permission check of canView in GridFieldPrintButton
A missing permission check in Silverstripe's GridFieldPrintButton allows unauthorized content authors to view restricted records.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-22728?
CVE-2023-22728 is a medium-severity missing authorization vulnerability in silverstripe-framework, published on 26 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.
Weakness: CWE-862
Which versions are affected by CVE-2023-22728?
2 open source packages ship an affected version, including silverstripe/framework. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | All versions | 4.12.5 |
silverstripe/framework Packagist | All versions | 4.12.5 |
Products include Silverstripe Framework.
How do I fix CVE-2023-22728?
Upgrade silverstripe/framework to 4.12.5 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-22728 being exploited?
There is no known exploitation of CVE-2023-22728 in the wild and no public exploit code.
Other vulnerabilities in silverstripe-framework
- CVE-2022-38148 Blind SQL Injection via GridFieldSortableHeader
- CVE-2022-38462 Reflected XSS in querystring parameters
- CVE-2025-30148 Silverstripe Framework has a XSS vulnerability in HTML editor
- CVE-2024-53277 Cross-site Scripting in form messages in silverstripe framework
- CVE-2024-32981 Cross-site Scripting vulnerability with encoded payload in silverstripe/framework
Sources
Also known as GHSA-jh3w-6jp2-vqqm.