{"action":"Upgrade silverstripe/framework to 4.0.1 or later.","affected":[{"fixed":"4.0.1","introduced":"4.0.0-rc1"}],"component":"silverstripe/framework","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["4.0.1"],"ghsa_id":"GHSA-r3pr-fh25-wrfc","id":"tcs_01M5KF7TY14H69WEZK80T447KM","modified_at":"2024-12-02T05:54:10.660338Z","published_at":"2024-05-27T22:54:06Z","references":["https://osv.dev/vulnerability/GHSA-r3pr-fh25-wrfc","https://github.com/silverstripe/silverstripe-framework/commit/7a79cd039a96ef54182263d5fbb72addf093b171","https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2017-010-1.yaml","https://github.com/silverstripe/silverstripe-framework","https://www.silverstripe.org/download/security-releases/ss-2017-010"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-r3pr-fh25-wrfc","url":"https://osv.dev/vulnerability/GHSA-r3pr-fh25-wrfc"}],"summary":"silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms"}