CVE-2023-48714

MEDIUM Year: 2023
CVSS v3 Score
4.3
Medium
Weakness Type
CWE-200
View all →

Vulnerability Description

Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAddExistingAutocompleter` component, the record's title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue.

Related Vulnerabilities

CVE-2011-1934

MEDIUM
CVSS:4.3(Medium)

lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1.

CWE-2002011

CVE-2012-1158

MEDIUM
CVSS:4.3(Medium)

Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export

CWE-2002012

CVE-2012-1159

MEDIUM
CVSS:4.3(Medium)

Moodle before 2.2.2: Overview report allows users to see hidden courses

CWE-2002012

CVE-2012-1161

MEDIUM
CVSS:4.3(Medium)

Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results

CWE-2002012

CVE-2012-5570

MEDIUM
CVSS:4.3(Medium)

The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users' email addresses.

CWE-2002012

CVE-2013-4317

MEDIUM
CVSS:4.3(Medium)

In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their ...

CWE-2002013