GitHub Advisoryadvisory · Packagist
GHSA-2pw2-qpcp-m47x Silverstripe CMS XSS Vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2020-9311
- Ecosystem
- Packagist
- Packages
- silverstripe/cms, silverstripe/framework
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2023-07-13
Affected packages
• Packagist silverstripe/cms: <= 4.5.0 (no fix yet)
• Packagist silverstripe/framework: >= 3.0.0, < 3.7.5 → fixed in 3.7.5
Description
In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted login form URLs.
Related
Alias · CVE (1)
- CVE-2020-9311 In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-9311 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2020-9311.yaml web
- https://github.com/silverstripe/silverstripe-cms package
- https://www.silverstripe.org/download/security-releases/CVE-2020-9311 web
- https://www.silverstripe.org/download/security-releases/cve-2020-9311 web