GitHub Advisoryadvisory · Packagist

GHSA-779c-7w4p-2c4g Silverstripe admin XSS Vulnerability via WYSIWYG editor

LOW Published 2024-05-22 Modified 2024-05-22 Official page ↗
Ecosystem
Packagist
Packages
silverstripe/admin
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-05-22

Affected packages

• Packagist silverstripe/admin: >= 1.0.3, < 1.0.4 → fixed in 1.0.4 • Packagist silverstripe/admin: >= 1.1.0, < 1.1.1 → fixed in 1.1.1

Description

It is possible for a bad actor with access to the CMS to make use of onmouseover or onmouseout attributes in the WYSIWYG editor to embed malicious javascript.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References