UpHeron
All vulnerabilities

Servers and applications

CVE-2023-48714

Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter

Severity
Medium 4.3
Published
22 Jan 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.13.39, 5.1.11
Also known as
GHSA-qm2j-qvq3-j29v
Sources
NVD, Project advisories (GitHub)

Description

Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAddExistingAutocompleter` component, the record's title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue.

Affected software

SoftwareAffected versions
Silverstripe CMSServers and applications · cpe:a:silverstripe:framework
  • Every version before 4.13.39
  • From 5.0.0 before 5.1.11
Silverstripe CMSServers and applications · github:silverstripe/silverstripe-framework
  • Every version before 4.13.39
  • From 5.0.0 before 5.1.11

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-48714
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-48714
  • GitHub Advisory Database https://github.com/advisories/GHSA-qm2j-qvq3-j29v
  • github.com https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-qm2j-qvq3-j29v