CVE-2023-48714: 
PHP vulnerability analysis and mitigation

CVE-2023-48714 affects the Silverstripe Framework, which forms the base of the Silverstripe content management system. The vulnerability was discovered and disclosed on January 23, 2024, affecting versions prior to 4.13.39 and 5.1.11. The issue involves unauthorized access to record titles through the GridFieldAddExistingAutocompleter component (Vendor Advisory).

The vulnerability allows users to access record titles they shouldn't have permission to view when those records can be added to a GridField using the GridFieldAddExistingAutocompleter component. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This indicates network accessibility, low attack complexity, required low privileges, no user interaction, unchanged scope, low confidentiality impact, and no impact on integrity or availability (GitHub Advisory).

The vulnerability results in unauthorized access to record titles that should be restricted, leading to potential information disclosure. While the impact is limited to viewing record titles, it represents a breach of access control mechanisms (Vendor Advisory).

The vulnerability has been fixed in Silverstripe Framework versions 4.13.39 and 5.1.11. Users are advised to upgrade to these patched versions to address the security issue (Vendor Advisory).