GitHub Advisoryadvisory · Packagist

GHSA-38h6-gmr2-j4wx Silverstripe Form Capture vulnerable to stored cross-site-scripting

MEDIUM Published 2023-04-03 Modified 2023-04-12 Official page ↗
Aliases
CVE-2023-28851
Ecosystem
Packagist
Packages
bigfork/silverstripe-form-capture, andrewhaine/silverstripe-form-capture
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-04-03

Affected packages

• Packagist bigfork/silverstripe-form-capture: >= 3.0.0, < 3.1.1 → fixed in 3.1.1 • Packagist andrewhaine/silverstripe-form-capture: >= 0.2.0, < 1.0.2 → fixed in 1.0.2 • Packagist andrewhaine/silverstripe-form-capture: >= 2.0.0, < 2.2.5 → fixed in 2.2.5 • Packagist andrewhaine/silverstripe-form-capture: >= 1.0.0, < 1.0.2 → fixed in 1.0.2

Description

Impact Improper escaping when presenting stored form submissions allowed for an attacker to perform a Cross-Site Scripting attack Patches The vulnerability was initially patched in version 1.0.2, and version 1.1.0 includes this patch. The bug was then accidentally re-introduced during a merge error, and has been re-patched in versions 2.2.5 and 3.1.1.

Related

Alias · CVE (1)

  • CVE-2023-28851 Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References