silverstripe/silverstripe-framework · Security
silverstripe/framework may disclose database credentials during connection failure
- GHSA ID
- GHSA-m2hh-2m46-x6j5
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
When running SilverStripe 3.7 or 4.x in dev mode with the mysqli database driver, there is a potential to disclose the connection details.
We have blacklisted the sensitive parts of the connection information from being included in dev mode stack traces when database errors occur.
CWEs
- CWE-209 · Generation of Error Message Containing Sensitive Information
References
- https://github.com/silverstripe/silverstripe-framework/commit/214e28127f5425b61c15b69f884afdbad31133c2 ↗
- https://github.com/silverstripe/silverstripe-framework/commit/54251952387394d72b221e797a80edfbf9a973ee ↗
- https://github.com/silverstripe/silverstripe-framework/commit/9aabe0a0f7a061d87cc92923f8811e14d7a032f5 ↗
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-018-1.yaml ↗
- https://www.silverstripe.org/download/security-releases/ss-2018-018 ↗
- https://github.com/advisories/GHSA-m2hh-2m46-x6j5 ↗