GHSA-256q-hx8w-xcqx Silverstripe Framework user enumeration via timing attack on login and password reset forms
Attackers can enumerate valid usernames by measuring response times on login and password reset forms in Silverstripe CMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-256q-hx8w-xcqx?
GHSA-256q-hx8w-xcqx is a vulnerability in silverstripe/framework, published on 10 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.
This was originally disclosed in https://www.silverstripe.org/download/security-releases/ss-2017-005/ for CMS 3 but was not patched in CMS 4+
References
Which versions are affected by GHSA-256q-hx8w-xcqx?
2 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | From 4.0.0 | 5.3.23 |
silverstripe/framework Packagist | From 4.0.0 | 5.3.23 |
How do I fix GHSA-256q-hx8w-xcqx?
Upgrade silverstripe/framework to 5.3.23 or later.
Is GHSA-256q-hx8w-xcqx being exploited?
There is no known exploitation of GHSA-256q-hx8w-xcqx in the wild and no public exploit code.