Cyber Resilience

CVE-2023-48714

Medium

Published: 23 January 2024

Published
23 January 2024
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0023 45.5th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-48714 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Silverstripe Framework. Its CVSS base score is 4.3 (Medium).

Operationally, ranked at the 45.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a…

more

`GridField` using the `GridFieldAddExistingAutocompleter` component, the record's title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

silverstripe
framework
≤ 4.13.39 · 5.0.0 — 5.1.11

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-200 CWE-732

Proper attribute retention and permitted-value enforcement limits unauthorized actors from accessing sensitive information lacking correct labels.

addresses: CWE-732 CWE-200

Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.

addresses: CWE-200 CWE-732

Documenting information locations and authorized users enables better protection against unauthorized exposure of sensitive data.

addresses: CWE-732 CWE-200

Places configuration items under formal management, enforcing correct permission assignments on critical resources.

addresses: CWE-200 CWE-732

Requiring equivalent controls at the alternate storage site prevents unauthorized exposure of sensitive backup data.

addresses: CWE-200 CWE-732

Protecting confidentiality of backup information prevents unauthorized exposure of sensitive data stored in backups.

addresses: CWE-200 CWE-732

Assessing control effectiveness and providing incident communication channels at alternate sites reduces the likelihood of sensitive information exposure to unauthorized actors.

addresses: CWE-200 CWE-732

Requiring protection of the program plan from unauthorized disclosure directly reduces exposure of sensitive security program details and control descriptions.

References