CVE-2023-48714 Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter
Attackers can view titles of restricted records via GridFieldAddExistingAutocompleter, exposing sensitive data to unauthorized users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-48714?
CVE-2023-48714 is a medium-severity vulnerability in silverstripe-framework, published on 23 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAddExistingAutocompleter` component, the record's title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue.
Which versions are affected by CVE-2023-48714?
4 open source packages ship an affected version, including silverstripe/framework. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | All versions | 4.13.39 |
silverstripe/framework Packagist | All versions | 4.13.39 |
silverstripe/framework Packagist | From 5.0.0 | 5.1.11 |
silverstripe/framework Packagist | From 5.0.0 | 5.1.11 |
Products include Silverstripe Framework.
How do I fix CVE-2023-48714?
Upgrade silverstripe/framework to a fixed version for your release line: 4.13.39 or 5.1.11.
Is CVE-2023-48714 being exploited?
There is no known exploitation of CVE-2023-48714 in the wild and no public exploit code.
Other vulnerabilities in silverstripe-framework
- CVE-2022-38148 Blind SQL Injection via GridFieldSortableHeader
- CVE-2022-38462 Reflected XSS in querystring parameters
- CVE-2025-30148 Silverstripe Framework has a XSS vulnerability in HTML editor
- CVE-2024-53277 Cross-site Scripting in form messages in silverstripe framework
- CVE-2024-32981 Cross-site Scripting vulnerability with encoded payload in silverstripe/framework
Sources
Also known as GHSA-qm2j-qvq3-j29v.