Vulnerability-Lookup

CVE-2023-32302 (GCVE-0-2023-32302)

Vulnerability from cvelistv5 – Published: 2023-08-01 10:44 – Updated: 2023-10-04 17:08

Authoritative user requested CVE rejection https://github.com/github/advisory-database/pull/2575#issuecomment-1745811653

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2023-10-04T17:08:00.239Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "Authoritative user requested CVE rejection\r\nhttps://github.com/github/advisory-database/pull/2575#issuecomment-1745811653"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-32302",
    "datePublished": "2023-08-01T10:44:39.231Z",
    "dateRejected": "2023-10-04T17:08:00.239Z",
    "dateReserved": "2023-05-08T13:26:03.877Z",
    "dateUpdated": "2023-10-04T17:08:00.239Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-32302\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-08-01T11:15:09.667\",\"lastModified\":\"2023-11-07T04:14:31.970\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: Authoritative user requested CVE rejection\\r\\nhttps://github.com/github/advisory-database/pull/2575#issuecomment-1745811653\"}],\"metrics\":{},\"references\":[]}}"
  }
}

GHSA-36XX-7VF6-7MV3

Vulnerability from github – Published: 2023-07-31 22:00 – Updated: 2023-10-04 17:11

Summary

Silverstripe Framework: Members with no password can be created and bypass custom login forms

Details

When a new Member record was created in the cms it was possible to set a blank password. If an attacker knows the email address of the user with the blank password then they can attempt to log in using an empty password. The default member authenticator, login form and basic auth all require a non-empty password, however if a custom authentication method is used it may allow a successful login with the empty password. Starting with this release, blank passwords are no no longer allowed when members are created in the CMS. Programatically created Member records, such as those used in unit tests, still allow blank passwords. You may have some Member records in your system already which have empty passwords. To detect these, you can loop over all Member records with Member::get() and pass each record into the below method. It might be sensible to create a BuildTask for this purpose. php private function memberHasBlankPassword(Member $member): bool { // skip default admin as this is created programatically if ($member->isDefaultAdmin()) { return false; } // return true if a blank password is valid for this member $authenticator = new MemberAuthenticator(); return $authenticator->checkPassword($member, '')->isValid(); } Once you have identified the records with empty passwords, it's up to you how to handle this. The most sensible way to resolve this is probably to generate a new secure password for each of these members, mark it as immediately expired, and email each affected member (assuming they have a valid email address in the system).

Users would need to opt-in to insecure behavior by using a configuration which allowed for empty passwords. These configurations are not expected and hence this advisory is primarily informational in nature.

Reported by: Sabina Talipova from Silverstripe and Christian Bünte

Severity ?

0.0 (None)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "silverstripe/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "4.13.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "silverstripe/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-32302"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-31T22:00:58Z",
    "nvd_published_at": "2023-08-01T11:15:09Z",
    "severity": "LOW"
  },
  "details": "When a new `Member` record was created in the cms it was possible to set a blank password. If an attacker knows the email address of the user with the blank password then they can attempt to log in using an empty password. The default member authenticator, login form and basic auth all require a non-empty password, however if a custom authentication method is used it may allow a successful login with the empty password. Starting with this release, blank passwords are no no longer allowed when members are created in the CMS. Programatically created `Member` records, such as those used in unit tests, still allow blank passwords. You may have some `Member` records in your system already which have empty passwords. To detect these, you can loop over all `Member` records with `Member::get()` and pass each record into the below method. It might be sensible to create a [`BuildTask`](https://api.silverstripe.org/5/SilverStripe/Dev/BuildTask.html) for this purpose.\n  ```php\n    private function memberHasBlankPassword(Member $member): bool\n    {\n        // skip default admin as this is created programatically\n        if ($member-\u003eisDefaultAdmin()) {\n            return false;\n        }\n        // return true if a blank password is valid for this member\n        $authenticator = new MemberAuthenticator();\n        return $authenticator-\u003echeckPassword($member, \u0027\u0027)-\u003eisValid();\n    }\n  ```\n  Once you have identified the records with empty passwords, it\u0027s up to you how to handle this. The most sensible way to resolve this is probably to generate a new secure password for each of these members, mark it as immediately expired, and email each affected member (assuming they have a valid email address in the system).\n\nUsers would need to opt-in to insecure behavior by using a configuration which allowed for empty passwords. These configurations are not expected and hence this advisory is primarily informational in nature.\n\nReported by: [Sabina Talipova](https://www.silverstripe.com/about-us/team/?member=sabina-talipova) from Silverstripe and [Christian B\u00fcnte](https://github.com/bimthebam)",
  "id": "GHSA-36xx-7vf6-7mv3",
  "modified": "2023-10-04T17:11:40Z",
  "published": "2023-07-31T22:00:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-36xx-7vf6-7mv3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32302"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/advisory-database/pull/2575"
    },
    {
      "type": "WEB",
      "url": "https://github.com/silverstripe/silverstripe-framework/commit/7b21b38ac4532d06565dfcefad50540ebd2b50f4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2023-32302.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/silverstripe/silverstripe-framework"
    },
    {
      "type": "WEB",
      "url": "https://github.com/silverstripe/silverstripe-framework/releases/tag/4.13.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/silverstripe/silverstripe-framework/releases/tag/5.0.13"
    },
    {
      "type": "WEB",
      "url": "https://www.silverstripe.org/download/security-releases/CVE-2023-32302"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Silverstripe Framework: Members with no password can be created and bypass custom login forms"
}

GSD-2023-32302

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

** REJECT ** Authoritative user requested CVE rejection https://github.com/github/advisory-database/pull/2575#issuecomment-1745811653

Aliases

CVE-2023-32302

Aliases

CVE-2023-32302

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-32302",
    "id": "GSD-2023-32302"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-32302"
      ],
      "details": "** REJECT ** Authoritative user requested CVE rejection\r\nhttps://github.com/github/advisory-database/pull/2575#issuecomment-1745811653",
      "id": "GSD-2023-32302",
      "modified": "2023-12-13T01:20:23.412976Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-32302",
        "STATE": "REJECT"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** REJECT ** Authoritative user requested CVE rejection\r\nhttps://github.com/github/advisory-database/pull/2575#issuecomment-1745811653"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.0.13",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.3.14",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-32302"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Silverstripe Framework is the MVC framework that powers Silverstripe CMS. When a new member record is created and a password is not set, an empty encrypted password is generated. As a result, if someone is aware of the existence of a member record associated with a specific email address, they can potentially attempt to log in using that empty password. Although the default member authenticator and login form require a non-empty password, alternative authentication methods might still permit a successful login with the empty password. This issue has been patched in versions 4.13.4 and 5.0.13.\n\n\n"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/silverstripe/silverstripe-framework/commit/7b21b38ac4532d06565dfcefad50540ebd2b50f4",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/silverstripe/silverstripe-framework/commit/7b21b38ac4532d06565dfcefad50540ebd2b50f4"
            },
            {
              "name": "https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-36xx-7vf6-7mv3",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Vendor Advisory"
              ],
              "url": "https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-36xx-7vf6-7mv3"
            },
            {
              "name": "https://github.com/silverstripe/silverstripe-framework/releases/tag/4.13.14",
              "refsource": "MISC",
              "tags": [
                "Release Notes"
              ],
              "url": "https://github.com/silverstripe/silverstripe-framework/releases/tag/4.13.14"
            },
            {
              "name": "https://github.com/silverstripe/silverstripe-framework/releases/tag/5.0.13",
              "refsource": "MISC",
              "tags": [
                "Release Notes"
              ],
              "url": "https://github.com/silverstripe/silverstripe-framework/releases/tag/5.0.13"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-08-07T22:15Z",
      "publishedDate": "2023-08-01T11:15Z"
    }
  }
}

FKIE_CVE-2023-32302

Vulnerability from fkie_nvd - Published: 2023-08-01 11:15 - Updated: 2023-11-07 04:14

Severity ?

Summary

Rejected reason: Authoritative user requested CVE rejection https://github.com/github/advisory-database/pull/2575#issuecomment-1745811653

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: Authoritative user requested CVE rejection\r\nhttps://github.com/github/advisory-database/pull/2575#issuecomment-1745811653"
    }
  ],
  "id": "CVE-2023-32302",
  "lastModified": "2023-11-07T04:14:31.970",
  "metrics": {},
  "published": "2023-08-01T11:15:09.667",
  "references": [],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Rejected"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-32302 (GCVE-0-2023-32302)

GHSA-36XX-7VF6-7MV3

GSD-2023-32302

FKIE_CVE-2023-32302

Tags

Sightings

Nomenclature