| Package | Affected versions | Patched versions |
|---|---|---|
| silverstripe/assets | ≥ 1.0.0, < 1.3.5≥ 1.4.0, < 1.4.4 | 1.3.51.4.4 |
| silverstripe/framework | ≥ 3.7.0, < 3.7.4≥ 4.0.0, < 4.3.6≥ 4.4.0, < 4.4.4< 3.6.8 | 3.7.44.3.64.4.43.6.8 |
| silverstripe | ≤ 4.3.3 |
SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free