Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2023-22728

Silverstripe Framework has missing permission check of canView in GridFieldPrintButton

Description

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

silverstripe silverstripe-framework

  • < 4.12.5affected

References