Vulnerability · Published Jul 15, 2020 · Assigned by mitre
CVE-2020-6164
High 7.5
In plain English
A high-severity security flaw in the silverstripe/cms package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to execution in a CLI context, and is not known to present a vulnerability through web-based access. As a side-effect, this preconfigured path also blocks the creation of other resources on this path (e.g. a page).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | silverstripe/cms | no fix listed | GHSA-gm5x-hpmw-xpxg |
| Packagist | silverstripe/framework | 4.4.7 | GHSA-gm5x-hpmw-xpxg |
| Packagist | silverstripe/framework | 4.5.4 | GHSA-gm5x-hpmw-xpxg |
Affected products (as reported)
References
- https://www.silverstripe.org/download/security-releases/CVE-2020-6164 x_refsource_CONFIRM