-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getkirby/cms | composer | >= 3.5.0, < 3.5.8.2 | 3.5.8.2 |
| getkirby/cms | composer | >= 3.6.0, < 3.6.6.2 | 3.6.6.2 |
| getkirby/cms | composer | >= 3.7.0, < 3.7.5.1 | 3.7.5.1 |
| getkirby/cms | composer | = 3.8.0 | 3.8.1 |
PHPPHPAll of the mentioned releases contain two patches for this vulnerability:
auth.debug option that can be enabled separately from the debug option. If disabled, auth errors are only printed to the PHP error log. This ensures that security-critical errors are only displayed if they are really necessary for debugging.We recommend to update to one of the patch releases. If you cannot update immediately, you can work around the issue by setting the auth.methods option to password, which disables the code-based login and password reset forms.
However please note that your site will still be vulnerable against another user enumeration issue that was also fixed in the same patch releases.
Thanks to Florian Merz (@florianmrz) of hatchery.io for responsibly reporting the identified issue.
Miggo AIRoot Cause AnalysisThe vulnerability stems from two main points: 1) Error leakage in challenge creation flow, and 2) Unhandled exceptions in login failure hooks. The patch notes specifically mention error handling improvements in auth challenge creation and hook processing. These functions are core components of Kirby's authentication system and align with the described vulnerability patterns. The Challenge::create method would be responsible for email-based challenges, while Auth::handleLoginFailed would trigger the problematic hook. The high confidence comes from the direct mapping between described vulnerability patterns and core authentication system components mentioned in the advisory.
Ongoing coverage of React2Shell