Back to CVE Browser

CVE-2019-12204

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1150%

EPSS Percentile7.98th

PublishedSep 25, 2019

Last ModifiedNov 21, 2024

Vulnerability Description

In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.

Affected Platforms (CPE)

📦

Silverstripe

Silverstripe

>= 4.1.0 and <= 4.3.3

References & Advisories

🔗 https://forum.silverstripe.org/c/releases

🔗 https://www.silverstripe.org/download/security-releases/

🔗 https://www.silverstripe.org/download/security-releases/CVE-2019-12204

🔗 https://forum.silverstripe.org/c/releases

🔗 https://www.silverstripe.org/download/security-releases/

🔗 https://www.silverstripe.org/download/security-releases/CVE-2019-12204

Related Vulnerabilities

CVE-2007-232110.0

Unspecified vulnerability in the search functionality in SilverStripe 2.0.0 has unknown impact and attack vectors.

CVE-2019-57159.8

All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3....

CVE-2020-93098.8

Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions (...

CVE-2019-124378.8

In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations...