CVE-2017-12849

5.3 mediumEPSS 1.1%

Medium (5.3) in silverstripe silverstripe. EPSS 1.1% chance of exploitation in the next 30 days.

Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.

Severity

CVSS 3.0

5.3 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2017-10-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

silverstripe:silverstripe

References

https://www.silverstripe.org/download/security-releases/ss-2017-005
https://www.silverstripe.org/download/security-releases/ss-2017-005

Check your stack JSON