5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-256q-hx8w-xcqx

GHSA-256q-hx8w-xcqx: Silverstripe Framework user enumeration via timing attack on login and password reset forms

Impact

User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.

This was originally disclosed in https://www.silverstripe.org/download/security-releases/ss-2017-005/ for CMS 3 but was not patched in CMS 4+

References

https://www.silverstripe.org/download/security-releases/ss-2017-005
https://www.silverstripe.org/download/security-releases/ss-2025-001

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-256q-hx8w-xcqx

GHSA-256q-hx8w-xcqx:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
silverstripe/framework	composer	>= 4.0.0, < 5.3.23	5.3.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a timing attack on login and password reset forms, allowing user enumeration. The provided patch (commit 3cafa4cbf838599b39b29fb940d21657686dcb17) addresses this by introducing a minimum execution time for sensitive operations. I analyzed the diff of this commit. The key changes involve wrapping the core logic of two functions, SilverStripe\Security\MemberAuthenticator\LostPasswordHandler::forgotPassword and SilverStripe\Security\MemberAuthenticator\MemberAuthenticator::authenticate, with a new function Security::withMinimumExecutionTime. This indicates that these two functions were the ones susceptible to the timing attack. The forgotPassword function is used in the password reset process, and the authenticate function is used in the login process, both of which were mentioned in the vulnerability description. The Security::withMinimumExecutionTime function itself is the mitigation, not a vulnerable function. The test file changes are for testing this new mitigation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.