CVE-2023-22728

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.

• CWE-862

• https://github.com/silverstripe/silverstripe-framework/commit/fd5d8217e83768d7bf841e94b2d4d82642d5bc58Patch
• https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-jh3w-6jp2-vqqmVendor Advisory
• https://github.com/silverstripe/silverstripe-framework/commit/fd5d8217e83768d7bf841e94b2d4d82642d5bc58Patch
• https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-jh3w-6jp2-vqqmVendor Advisory

Published

Apr 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22721Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps fo…5.4
• CVE-2023-22722GLPI is a Free Asset and IT Management Software package. Ver…6.1
• CVE-2023-22724GLPI is a Free Asset and IT Management Software package. Ver…4.8
• CVE-2023-22725GLPI is a Free Asset and IT Management Software package. Ver…4.8
• CVE-2023-22726act is a project which allows for local running of github ac…8.8
• CVE-2023-22727CakePHP is a development framework for PHP web apps. In affe…9.8
• CVE-2023-22729Silverstripe Framework is the Model-View-Controller framewor…6.1
• CVE-2023-2273Rapid7 Insight Agent token handler versions 3.2.6 and below,…7.5
• CVE-2023-22730Shopware is an open source commerce platform based on Symfon…7.5
• CVE-2023-22731Shopware is an open source commerce platform based on Symfon…8.8
• CVE-2023-22732Shopware is an open source commerce platform based on Symfon…9.8
• CVE-2023-22733Shopware is an open source commerce platform based on Symfon…6.5