GitHub Advisoryadvisory · Packagist

GHSA-74j9-xhqr-6qv3 Reflected Cross Site Scripting (XSS) in error message

LOW Published 2025-01-23 Modified 2025-01-23 Official page ↗
Ecosystem
Packagist
Packages
silverstripe/framework
Severity
Low
Weaknesses
CWE-79
Reviewed
2025-01-23

Affected packages

• Packagist silverstripe/framework: < 5.3.8 → fixed in 5.3.8

Description

If a website has been set to the "dev" environment mode, a URL can be provided which includes an XSS payload which will be executed in the resulting error message.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References