-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/cms | composer | <= 4.5.0 | |
| silverstripe/framework | composer | >= 4.0.0, < 4.4.7 | 4.4.7 |
| silverstripe/framework | composer | >= 4.5.0, < 4.5.4 | 4.5.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from preconfigured routes in silverstripe/framework mapping to controllers (SapphireREPL, InstallerTest, SapphireInfo) that disclosed CMS presence. The GitHub patch (91d30db/cce2b16) removed these routes and deprecated/removed the associated controllers. The '/interactive' route specifically mapped to SapphireREPL, which provided a detectable endpoint. These controllers' existence in vulnerable versions created a predictable URL pattern, enabling attackers to identify Silverstripe usage. The high confidence comes from explicit route removal in the patch and deprecation notices in code comments.
PHPPHPOngoing coverage of React2Shell