CVE-2023-48714 - OpenCVE

Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAddExistingAutocompleter` component, the record's title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Silverstripe	Framework

Configuration 1 [-]

OR	cpe:2.3:a:silverstripe:framework::::::::
	cpe:2.3:a:silverstripe:framework::::::::

No data.

References

Link	Providers
https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-qm2j-qvq3-j29v
https://www.silverstripe.org/download/security-releases/CVE-2023-48714

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-01-23T13:49:27.350Z

Updated: 2024-08-02T21:37:54.676Z

Reserved: 2023-11-17T19:43:37.555Z

Link: CVE-2023-48714

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2024-01-23T14:15:37.780

Modified: 2024-02-02T05:06:50.870

Link: CVE-2023-48714

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-48714", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-11-17T19:43:37.555Z", "datePublished": "2024-01-23T13:49:27.350Z", "dateUpdated": "2024-08-02T21:37:54.676Z"}, "containers": {"cna": {"title": "Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-qm2j-qvq3-j29v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-qm2j-qvq3-j29v"}, {"name": "https://www.silverstripe.org/download/security-releases/CVE-2023-48714", "tags": ["x_refsource_MISC"], "url": "https://www.silverstripe.org/download/security-releases/CVE-2023-48714"}], "affected": [{"vendor": "silverstripe", "product": "silverstripe-framework", "versions": [{"version": "< 4.13.39", "status": "affected"}, {"version": ">= 5.0.0, < 5.1.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-01-23T13:49:27.350Z"}, "descriptions": [{"lang": "en", "value": "Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAddExistingAutocompleter` component, the record's title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue."}], "source": {"advisory": "GHSA-qm2j-qvq3-j29v", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:37:54.676Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-qm2j-qvq3-j29v", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-qm2j-qvq3-j29v"}, {"name": "https://www.silverstripe.org/download/security-releases/CVE-2023-48714", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.silverstripe.org/download/security-releases/CVE-2023-48714"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:*", "matchCriteriaId": "FBFF168A-BDC7-4903-9FC8-EDDC61DF5F5D", "versionEndExcluding": "4.13.39", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED559465-A475-47D0-80A1-E56E9E84522B", "versionEndExcluding": "5.1.11", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAddExistingAutocompleter` component, the record's title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue."}, {"lang": "es", "value": "Silverstripe Framework es el framework que forma la base del sistema de gesti\u00f3n de contenidos Silverstripe. Antes de las versiones 4.13.39 y 5.1.11, si un usuario no pod\u00eda ver un registro, pero ese registro se pod\u00eda agregar a un `GridField` usando el componente `GridFieldAddExistingAutocompleter`, ese usuario pod\u00eda acceder al t\u00edtulo del registro. Las versiones 4.13.39 y 5.1.11 contienen una soluci\u00f3n para este problema."}], "id": "CVE-2023-48714", "lastModified": "2024-02-02T05:06:50.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-01-23T14:15:37.780", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-qm2j-qvq3-j29v"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://www.silverstripe.org/download/security-releases/CVE-2023-48714"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}