-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the missing salt reset in the Member model's pre-write hook. The patch adds 'this->Salt = '';' in onBeforeWrite() when password changes are detected. This method handles password encryption logic, and the absence of salt reset in vulnerable versions meant user-specific encryption parameters weren't refreshed, leaving persistent authentication tokens valid despite password changes. The direct correlation between the fix location and vulnerability description confirms this as the vulnerable function.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/framework | composer | >= 3.1.19-rc1, < 3.1.20 | 3.1.20 |
| silverstripe/framework | composer | >= 3.2.4-rc1, < 3.2.5 | 3.2.5 |
| silverstripe/framework | composer | >= 3.3.2-rc1, < 3.3.3 | 3.3.3 |
| silverstripe/framework | composer | >= 3.4.0-rc1, < 3.4.1 | 3.4.1 |
Ongoing coverage of React2Shell