Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

SilverStripe Framework Leaks Database Password in Dev Mode

published 2 years ago
Summary

Running SilverStripe in dev mode with a MySQL database can accidentally reveal database login credentials if something goes wrong. This happens because error messages show sensitive connection details. To fix, upgrade to a version where this issue has been addressed or use a different database driver.

What to do
  • Update silverstripe framework to version 3.7.1.
  • Update silverstripe framework to version 4.0.5.
  • Update silverstripe framework to version 4.1.3.
  • Update silverstripe framework to version 4.2.2.
Affected software
Ecosystem VendorProductAffected versions
composer silverstripe framework >= 3.7.0-rc1, < 3.7.1
>= 4.0.0-rc1, < 4.0.5
>= 4.1.0-rc1, < 4.1.3
>= 4.2.0-rc1, < 4.2.2
Fix: upgrade to 3.7.1
Original advisory text
silverstripe/framework may disclose database credentials during connection failure
When running SilverStripe 3.7 or 4.x in dev mode with the mysqli database driver, there is a potential to disclose the connection details.

We have blacklisted the sensitive parts of the connection information from being included in dev mode stack traces when database errors occur.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Type
CWE-209Generation of Error Message Containing Sensitive Information
Timeline
Published28 May 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-m2hh-2m46-x6j5 · GHSA
Track software like this
Free during beta