| Package | Affected versions | Patched versions |
|---|---|---|
| silverstripe/framework | ≥ 3.1.19-rc1, < 3.1.20≥ 3.2.4-rc1, < 3.2.5≥ 3.3.2-rc1, < 3.3.3≥ 3.4.0-rc1, < 3.4.1 | 3.1.203.2.53.3.33.4.1 |
When a user changes their password, the internal salt used for hashing their password is not updated.
Although this is not considered a security vulnerability, this behaviour has been improved to ensure the salt is reset on change of password.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free