| Package | Affected versions | Patched versions |
|---|---|---|
| silverstripe/hybridsessions | ≥ 1.0.0, < 2.4.1≥ 2.5.0, < 2.5.1 | 2.4.12.5.1 |
| silverstripe | = 2.5.0≤ 2.4.0 |
When using the hybridsessions module is used without the session-manager module installed and sessions IDs are saved to disk, unexpired SessionIDs of logged out users can still be used to make authenticated requests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free