CVEvulnerability
CVE-2010-4823
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-09-17
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the httpError method in sapphire/core/control/RequestHandler.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when custom error handling is not used, allows remote attackers to inject arbitrary web script or HTML via "missing URL actions."
Affected configurations
• silverstripe silverstripe 2.3.0
• silverstripe silverstripe 2.3.1
• silverstripe silverstripe 2.3.2
• silverstripe silverstripe 2.3.3
• silverstripe silverstripe 2.3.4
• silverstripe silverstripe 2.3.5
• silverstripe silverstripe 2.3.6
• silverstripe silverstripe 2.3.7
• silverstripe silverstripe 2.3.8
• silverstripe silverstripe 2.3.9
• silverstripe silverstripe 2.4.0
• silverstripe silverstripe 2.4.1
• silverstripe silverstripe 2.4.2
• silverstripe silverstripe 2.4.3
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4 Exploit, Patch, Vendor Advisory
- http://open.silverstripe.org/changeset/114444 Exploit, Patch
- http://secunia.com/advisories/42346 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2011/01/03/12 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/04/30/1 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/04/30/3 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/05/01/3 www.openwall.com
- http://www.osvdb.org/69886 www.osvdb.org
- http://www.securityfocus.com/bid/45367 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/63988 exchange.xforce.ibmcloud.com
- http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4 Exploit, Patch, Vendor Advisory
- http://open.silverstripe.org/changeset/114444 Exploit, Patch
- http://secunia.com/advisories/42346 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2011/01/03/12 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/04/30/1 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/04/30/3 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/05/01/3 www.openwall.com
- http://www.osvdb.org/69886 www.osvdb.org
- http://www.securityfocus.com/bid/45367 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/63988 exchange.xforce.ibmcloud.com