NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

silverstripe/framework Privilege Escalation Risk in Member Edit formGHSA-xpff-c35g-j3cr

MEDIUMFix: silverstripe/silverstripe-framework@5771388

GHSA-xpff-c35g-j3cr is a medium-severity (CVSS 6.5) vulnerability in silverstripe/framework. A fix is available for silverstripe/framework — see the affected versions and patch details below.

Published
Updated
Affected
4 pkgs
Patched
4 / 4
Exploits
None indexed
Exploitation data as of Dec 2, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

4 pkgs affected
🐘silverstripe/framework🐘silverstripe/framework🐘silverstripe/framework🐘silverstripe/framework

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

A member with the permission EDIT_PERMISSIONS and access to the "Security" section is able to re-assign themselves (or another member) to ADMIN level.

CMS Fields for the member are constructed using DirectGroups instead of Groups relation which results in bypassing security logic preventing privilege escalation.

Affected Packages

4 total 4 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistsilverstripe/framework≥ 3.5.7-rc1&&< 3.5.83.5.8composer require silverstripe/framework:^3.5.8
🐘Packagistsilverstripe/framework≥ 3.6.0-rc1&&< 3.6.63.6.6composer require silverstripe/framework:^3.6.6
🐘Packagistsilverstripe/framework≥ 4.0.0-rc1&&< 4.0.44.0.4composer require silverstripe/framework:^4.0.4
🐘Packagistsilverstripe/framework≥ 4.1.0-rc1&&< 4.1.14.1.1composer require silverstripe/framework:^4.1.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for silverstripe/framework, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update silverstripe/framework to 3.5.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-xpff-c35g-j3cr is resolved across your whole dependency graph.

  3. Workarounds

    Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.

Frequently Asked Questions

A member with the permission `EDIT_PERMISSIONS` and access to the "Security" section is able to re-assign themselves (or another member) to `ADMIN` level. CMS Fields for the member are constructed using DirectGroups instead of Groups relation which results in bypassing security logic preventing privilege escalation.
O3 Security · Impact-Aware SCA

Is GHSA-xpff-c35g-j3cr in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
silverstripe/framework Privilege Escalation Risk in…