UpHeron
All vulnerabilities

Servers and applications

CVE-2020-6165

SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The automatic permission-checking mechanism in the silverstripe/graphql module does not provide complete protection against lists that are limited (e.g., through pagination), resulting in records that should have failed a permission check being…

Severity
Medium 5.3
Published
15 Jul 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.2.4, 3.3.0, 4.5.3
Sources
NVD

Affected software

SoftwareAffected versions
Silverstripe CMSServers and applications · cpe:a:silverstripe:silverstripe
  • From 3.2.0 before 3.2.4
  • From 3.2.5 before 3.3.0
  • From 4.5.0 before 4.5.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-6165
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-6165