CVE-2020-6164: Information Exposure

July 15, 2020 (updated July 21, 2021)

In SilverStripe, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to execution in a CLI context, and is not known to present a vulnerability through web-based access. As a side effect, this preconfigured path also blocks the creation of other resources on this path (e.g. a page).

References

nvd.nist.gov/vuln/detail/CVE-2020-6164
www.silverstripe.org/download/security-releases/CVE-2020-6164

Code Behaviors & Features

Detect and mitigate CVE-2020-6164 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →