From acc855756c09e99de111187efc90c96fa4a1430e Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 27 May 2024 23:25:30 +0000
Subject: [PATCH] Publish GHSA-crr3-h4m8-7f56

---
 .../GHSA-crr3-h4m8-7f56.json                  | 84 +++++++++++++++++++
 1 file changed, 84 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/05/GHSA-crr3-h4m8-7f56/GHSA-crr3-h4m8-7f56.json

diff --git a/advisories/github-reviewed/2024/05/GHSA-crr3-h4m8-7f56/GHSA-crr3-h4m8-7f56.json b/advisories/github-reviewed/2024/05/GHSA-crr3-h4m8-7f56/GHSA-crr3-h4m8-7f56.json
new file mode 100644
index 00000000000..8c6c76f46a5
--- /dev/null
+++ b/advisories/github-reviewed/2024/05/GHSA-crr3-h4m8-7f56/GHSA-crr3-h4m8-7f56.json
@@ -0,0 +1,84 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-crr3-h4m8-7f56",
+  "modified": "2024-05-27T23:23:51Z",
+  "published": "2024-05-27T23:23:51Z",
+  "aliases": [
+
+  ],
+  "summary": "silverstripe/framework vulnerable to member disclosure in login form",
+  "details": "There is a user ID enumeration vulnerability in our brute force error messages.\n\n- Users that don't exist in will never get a locked out message\n- Users that do exist, will get a locked out message\n\nThis means an attacker can infer or confirm user details that exist in the member table.\n\nThis issue has been resolved by ensuring that login attempt logging and lockout process works equivalently for non-existent users as it does for existant users.\n\nThis is a regression of [SS-2017-002](https://www.silverstripe.org/download/security-releases/ss-2017-002).",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "silverstripe/framework"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.0.0-rc1"
+            },
+            {
+              "fixed": "4.0.4"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "silverstripe/framework"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.1.0-rc1"
+            },
+            {
+              "fixed": "4.1.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/silverstripe/silverstripe-framework/commit/5887201dd578a5b9779c33a182153d2ce973ab41"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-010-1.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/silverstripe/silverstripe-framework"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.silverstripe.org/download/security-releases/ss-2018-010"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-27T23:23:51Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file