GHSA-m2hh-2m46-x6j5: 
PHP vulnerability analysis and mitigation

A database credentials disclosure vulnerability (SS-2018-018) was identified in SilverStripe Framework versions 3.7 and 4.x. The vulnerability was discovered in 2018 and affected multiple versions including ^3.7, ^4.0, with fixes released in versions 3.7.1, 4.0.5, 4.1.3, and 4.2.2. The issue specifically impacted systems running in development mode with the mysqli database driver (Silverstripe Advisory).

The vulnerability occurs when running SilverStripe 3.7 or 4.x in development mode with the mysqli database driver, where database connection details could potentially be exposed through stack traces during database connection failures. The issue has been assigned a moderate severity rating with a CVSS score of 6.5, indicating a significant but not critical security risk (GitHub Advisory).

The vulnerability could lead to the disclosure of sensitive database connection credentials when database errors occur in development mode. This exposure of credentials could potentially allow unauthorized access to the database if the information falls into malicious hands (GitHub Advisory).

The vulnerability requires the application to be running in development mode with the mysqli database driver, and a database connection failure must occur for the credentials to be exposed. The attack vector is network-based with low attack complexity and requires low privileges (GitHub Advisory).

The issue has been fixed by blacklisting sensitive parts of the connection information from being included in development mode stack traces when database errors occur. Users should upgrade to the patched versions: 3.7.1, 4.0.5, 4.1.3, or 4.2.2, depending on their current version (Silverstripe Advisory).