--- title: "CX-2022-5005" date: "2022-04-28T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5005/" --- # CX-2022-5005 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) CVE-2022-0227 **Published:** Apr 28, 2022 4.3 Medium Severity business logic packagist php @ @khanhchauminh Reported by Checkmarx Zero Details Overview ## Summary SilverStripe Framework is vulnerable to Business Logic Errors in the Failed login count since that value can be a negative number. ## Product `silverstripe/silverstripe-framework` prior to 4.10.1. ## Impact Security weaknesses in business logic can allow a user to perform something that the business does not allow, which can be damaging to a whole application. Since they usually entail acceptable use of the application’s functionality, they might be difficult to detect automatically. ## Steps to reproduce 1. After login, go to Security page under the path /admin/security/ 2. Click on any member record 3. In the member edit form, enter a negative number at Failed login count field then click on Save button. ### Expected result: You will see that the member record has been edited successfully with the negative value in the Failed login count field. This is not true logic because it must be non-negative ( >=0 ). ## Remediation Update `silverstripe/silverstripe-framework` to version 4.10.1. ## Credit This issue was reported by @khanhchauminh through huntr.dev. ## Resources 1. [Disclosure](https://huntr.dev/bounties/57124ed5-4b68-4934-8325-2c546257f2e4/) 2. [cbf2987](https://github.com/silverstripe/silverstripe-framework/commit/cbf2987a616e9ef4d7eccae5d763ef2179bdbcc2) 0 Medium Severity CVSS v3.1 Score 4.3 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None Advisory Timeline1. Disclosed Jan 11, 2022 ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)