From 4c7bc19637a311f448e2eaf0ab13cbd3e0e1c2e6 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 23 May 2024 19:38:46 +0000
Subject: [PATCH] Publish GHSA-8v6m-7f5v-hhx6

---
 .../GHSA-8v6m-7f5v-hhx6.json                  | 103 ++++++++++++++++++
 1 file changed, 103 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/05/GHSA-8v6m-7f5v-hhx6/GHSA-8v6m-7f5v-hhx6.json

diff --git a/advisories/github-reviewed/2024/05/GHSA-8v6m-7f5v-hhx6/GHSA-8v6m-7f5v-hhx6.json b/advisories/github-reviewed/2024/05/GHSA-8v6m-7f5v-hhx6/GHSA-8v6m-7f5v-hhx6.json
new file mode 100644
index 00000000000..51fd8d17bbe
--- /dev/null
+++ b/advisories/github-reviewed/2024/05/GHSA-8v6m-7f5v-hhx6/GHSA-8v6m-7f5v-hhx6.json
@@ -0,0 +1,103 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8v6m-7f5v-hhx6",
+  "modified": "2024-05-23T19:37:11Z",
+  "published": "2024-05-23T19:37:11Z",
+  "aliases": [
+
+  ],
+  "summary": "Silverstripe Brute force bypass on default admin",
+  "details": "Default Administrator accounts were not subject to the same brute force protection afforded to other Member accounts. Failed login counts were not logged for default admins resulting in unlimited attempts on the default admin username and password.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "silverstripe/framework"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.1.18"
+            },
+            {
+              "fixed": "3.1.19"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "silverstripe/framework"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.2.3"
+            },
+            {
+              "fixed": "3.2.4"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "silverstripe/framework"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.3.1"
+            },
+            {
+              "fixed": "3.3.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/silverstripe/silverstripe-framework/commit/f32c893546340c8c279fd1ab6d4269e9d6539bc2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-005-1.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/silverstripe/silverstripe-framework"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.silverstripe.org/download/security-releases/ss-2016-005"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-307"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-23T19:37:11Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file