-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key functions in the authentication flow: 1) authenticateMember didn't handle non-existent users equivalently to existing ones by creating temporary members for validation, creating differential lockout messages. 2) recordLoginAttempt's conditional logic failed to account for lockout configuration when login_recording was disabled, preventing proper tracking of invalid attempts. The patch added temporary member creation in authenticateMember and modified recordLoginAttempt's condition to consider lockout settings, confirming these were the vulnerable points.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/framework | composer | >= 4.0.0-rc1, < 4.0.4 | 4.0.4 |
| silverstripe/framework | composer | >= 4.1.0-rc1, < 4.1.1 | 4.1.1 |
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report