Advisory Database
  • Advisories
  • Dependency Scanning
  1. composer
  2. ›
  3. silverstripe/framework
  4. ›
  5. SS-2016-005

SS-2016-005: Brute force bypass on default admin

May 11, 2016

Default Administrator accounts were not subject to the same brute force protection afforded to other Member accounts. Failed login counts were not logged for default admins resulting in unlimited attempts on the default admin username and password.

References

  • www.silverstripe.org/download/security-releases/ss-2016-005
  • github.com/silverstripe/silverstripe-framework/commit/f32c893546340c8c279fd1ab6d4269e9d6539bc2

Code Behaviors & Features

Detect and mitigate SS-2016-005 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 3.3.0-alpha before 3.3.2-rc1, all versions starting from 3.2.0-alpha before 3.2.4-rc1, all versions before 3.1.19-rc1

Fixed versions

  • 3.1.19
  • 3.1.19-rc1
  • 3.2.4
  • 3.2.4-rc1
  • 3.3.2
  • 3.3.2-rc1

Solution

Upgrade to versions 3.1.19, 3.1.19-rc1, 3.2.4, 3.2.4-rc1, 3.3.2, 3.3.2-rc1 or above.

Source file

packagist/silverstripe/framework/SS-2016-005.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:16:14 +0000.