Description

SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain version information via a direct request to (1) apphire/silverstripe_version or (2) cms/silverstripe_version.

Remediation

References

CVE-2010-5078

Related Vulnerabilities

WordPress Plugin Feed Them Gallery Cross-Site Scripting (1.1.8)

Python Improper Neutralization of Special Elements used in a Command ('Command Injection') Vulnerability (CVE-2024-9287)

MongoDb Insufficient Session Expiration Vulnerability (CVE-2019-2386)

MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2020-35480)

SharePoint Improper Input Validation Vulnerability (CVE-2009-3830)

Severity

Medium

Classification

CVE-2010-5078 CWE-264

Tags

Missing Update Known Vulnerabilities