GHSA-256q-hx8w-xcqx: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-256q-hx8w-xcqx) affects Silverstripe Framework versions 4.0.0 through 5.3.23, discovered and disclosed on April 10, 2025. This security issue allows user enumeration through timing attacks on the login and password reset forms. The vulnerability was originally identified in CMS 3 but remained unpatched in CMS 4 and later versions (Silverstripe Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges or user interaction, has unchanged scope, and can impact confidentiality but not integrity or availability (GitHub Advisory).

The vulnerability allows attackers to perform timing attacks on the login and password reset forms to enumerate valid user accounts in the system. This information disclosure could potentially be used as a stepping stone for further attacks by identifying valid user accounts (Silverstripe Advisory).

The vulnerability is exploitable remotely through network access to the login and password reset forms. No special privileges or user interaction is required to exploit this vulnerability, making it relatively straightforward to execute timing attacks (GitHub Advisory).

The vulnerability has been fixed in Silverstripe Framework version 5.3.23. Users are advised to upgrade to this version or later to address the security issue. The fix introduces delays to prevent time-based attacks on the authentication system (Silverstripe Advisory).