-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing lockout checks in the default admin authentication flow. The commit diff shows MemberAuthenticator.php's authenticate_member() method previously lacked a $member->isLockedOut() check before validating default admin credentials. This allowed attackers to bypass brute force protections by targeting the default admin account. The patch added the missing lockout check and associated failed login tracking, confirming this was the vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/framework | composer | >= 3.1.18, < 3.1.19 | 3.1.19 |
| silverstripe/framework | composer | >= 3.2.3, < 3.2.4 | 3.2.4 |
| silverstripe/framework | composer | >= 3.3.1, < 3.3.2 | 3.3.2 |
Ongoing coverage of React2Shell