CVE-2013-6789: security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remo...

Security readout for executives and security teams

SilverStripe 3.0.3 could accept login credentials in a URL query string. That can place usernames and passwords in access logs, Referer logs, and browser history. The main business risk is credential exposure, especially on legacy public sites with retained logs. Exposure is likely limited to legacy SilverStripe 3.0.3 deployments or code derived from the affected MemberLoginForm behavior, especially internet-facing login pages and environments retaining web-server logs. Treat this as a targeted legacy cleanup item. It is not evidenced as actively exploited, but exposed passwords in logs can create account compromise risk and audit concerns. Mitigation focus: Check SilverStripe vendor guidance and the referenced commit for the supported fix path.; Upgrade or patch affected SilverStripe 3.0.3 deployments to remove GET credential support.; Ensure login forms submit credentials only through POST over HTTPS..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.