-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/cms | composer | < 3.5.5 | 3.5.5 |
| silverstripe/cms | composer | >= 3.6, < 3.6.1 | 3.6.1 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from measurable timing differences in user existence checks during authentication flows. The SecurityController methods handle form submissions while Member class methods implement security-critical operations. Pre-patch implementations would execute different code paths (password hashing/email sending) based on user validity, creating observable timing variances. These functions directly process sensitive authentication operations and would appear in stack traces during exploitation attempts.
Ongoing coverage of React2Shell