Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2017-12849

Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.

VectorNETWORK

PublishedOct 12, 2017, 15:29

Published Bycve@mitre.org

Base Score

Score5.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

silverstripe/cms(Packagist)03.5.5N/A

silverstripe/cms(Packagist)3.63.6.1N/A

References

https://www.silverstripe.org/download/security-releases/ss-2017-005

Weakness Type

CWE-200

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base SeverityMedium

Version

3.0

Attack Vector (AV)

NETWORK