silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled
Low severity
GitHub Reviewed
Published
May 27, 2024
to the GitHub Advisory Database
•
Updated May 27, 2024
Package
Affected versions
>= 3.1.19-rc1, < 3.1.20
>= 3.2.4-rc1, < 3.2.5
>= 3.3.2-rc1, < 3.3.3
>= 3.4.0-rc1, < 3.4.1
Patched versions
3.1.20
3.2.5
3.3.3
3.4.1
Description
Published to the GitHub Advisory Database
May 27, 2024
Reviewed
May 27, 2024
Last updated
May 27, 2024
If remember me is on and users log in with the box checked, if the developer then disabled "remember me" function, any pre-existing cookies will continue to authenticate users.
References