Vulnerability CVE-2023-32302
Published: 2023-08-01

Description:
Silverstripe Framework is the MVC framework that powers Silverstripe CMS. When a new member record is created and a password is not set, an empty encrypted password is generated. As a result, if someone is aware of the existence of a member record associated with a specific email address, they can potentially attempt to log in using that empty password. Although the default member authenticator and login form require a non-empty password, alternative authentication methods might still permit a successful login with the empty password. This issue has been patched in versions 4.13.4 and 5.0.13.

Type:

CWE-20

 (Improper Input Validation)

 References:
https://github.com/silverstripe/silverstripe-framework/commit/7b21b38ac4532d06565dfcefad50540ebd2b50f4
https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-36xx-7vf6-7mv3
https://github.com/silverstripe/silverstripe-framework/releases/tag/4.13.14
https://github.com/silverstripe/silverstripe-framework/releases/tag/5.0.13
Copyright 2026, cxsecurity.com

 

Back to Top