CVE-2019-12203

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

SilverStripe through 4.3.3 allows session fixation in the "change password" form.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://forum.silverstripe.org/c/releasesRelease Notes, Vendor Advisory
https://www.silverstripe.org/download/security-releases/Vendor Advisory
https://www.silverstripe.org/download/security-releases/CVE-2019-12203Vendor Advisory
https://forum.silverstripe.org/c/releasesRelease Notes, Vendor Advisory
https://www.silverstripe.org/download/security-releases/Vendor Advisory
https://www.silverstripe.org/download/security-releases/CVE-2019-12203Vendor Advisory

Timeline

Published: Sep 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-122049.8In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.CVE-2019-122056.1SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.CVE-2019-122069.8njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxt_utf8_encode in nxt_utf8.c.CVE-2019-122079.8njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c.CVE-2019-122089.8njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njs_function_native_call in njs/njs_function.c.CVE-2019-122097.5Yubico pam-u2f 1.0.7 attempts parsing of the configured authfile (default $HOME/.config/Yubico/u2f_keys) as root (unless openasuser was enab CVE-2019-12217.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip CVE-2019-122108.1In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed CVE-2019-122117.5When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp file, but a memcpy occurs in which the CVE-2019-122127.5When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due to improper processi CVE-2019-122136.5When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, leading to stack exhaust CVE-2019-122147.5In FreeImage 3.18.0, an out-of-bounds access occurs because of mishandling of the OpenJPEG j2k_read_ppm_v3 function in j2k.c. The value of l