Description
In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because the 4.x release has built-in versioning. However, nothing in the upgrade process automates the destruction of these insecure artefacts, nor alerts the user to the criticality of destruction.)
References (3)
Core 3
Core References
Product, Third Party Advisory x_refsource_misc
https://github.com/symbiote/silverstripe-versionedfiles
Product, Third Party Advisory x_refsource_misc
https://github.com/silverstripe/silverstripe-framework
Vendor Advisory x_refsource_confirm
https://www.silverstripe.org/download/security-releases/cve-2019-16409
Scores
CVSS v3
5.3
EPSS
0.0120
EPSS Percentile
64.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
Status
published
Products (4)
silverstripe/framework
4.0.0 - 4.3.5Packagist
silverstripe/silverstripe
3.0.0 - 3.7.4
symbiote/silverstripe-versionedfiles
0Packagist
symbiote/versionedfiles
< 2.0.3
Published
Sep 26, 2019
Tracked Since
Feb 18, 2026