Description

security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history, a similar vulnerability to CVE-2013-2653.

Remediation

References

CVE-2013-6789

Related Vulnerabilities

Oracle Database Server CVE-2016-5516 Vulnerability (CVE-2016-5516)

XWiki Missing Authorization Vulnerability (CVE-2022-41929)

Apache Tomcat Insufficient Technical Documentation Vulnerability (CVE-2026-59084)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-1756)

Grafana Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-19039)

Severity

Medium

Classification

CVE-2013-6789 CWE-200

Tags

Missing Update Known Vulnerabilities