SilverStripe contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when a weakness related to the 'changepassword' functionality due to an HTTP referer leak is exploited, which will disclose potentially sensitive information to a remote attacker.

Upgrade to version 2.4.4-rc1 or 2.3.10-rc1 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2010-5080 (see also: NVD)
• Secunia Advisory ID: 42346
• Vendor Specific News/Changelog Entry: http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.10
  http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.4
  http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.4
  http://silverstripe.org/releases-and-announcements/show/15131
• Vendor Specific Advisory URL: http://open.silverstripe.org/changeset/114758
  http://silverstripe.org/releases-and-announcements/show/15132
• Other Advisory URL: http://www.openwall.com/lists/oss-security/2011/01/03/12
  http://www.openwall.com/lists/oss-security/2012/04/30/1
  http://www.openwall.com/lists/oss-security/2012/04/30/1
  http://www.openwall.com/lists/oss-security/2012/04/30/3
  http://www.openwall.com/lists/oss-security/2012/04/30/3
  http://www.openwall.com/lists/oss-security/2012/05/01/3
  http://www.openwall.com/lists/oss-security/2012/05/01/3

• Not Available