GitHub Advisoryadvisory · Packagist
GHSA-9cx2-hj6m-fv58 Silverstripe XSS in shortcodes
MEDIUM
Official page ↗
- Aliases
- CVE-2022-38724
- Ecosystem
- Packagist
- Packages
- silverstripe/assets, silverstripe/framework
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2022-11-21
Affected packages
• Packagist silverstripe/assets: >= 1.0.0, < 1.11.1 → fixed in 1.11.1
• Packagist silverstripe/framework: >= 4.0.0, < 4.11.13 → fixed in 4.11.13
Description
A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used to inject a JavaScript payload on the front end of the site. The shortcode providers that ship with Silverstripe CMS have been reviewed and attribute whitelists have been implemented where appropriate to negate this risk.
Related
Alias · CVE (1)
- CVE-2022-38724 Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-38724 advisory
- https://forum.silverstripe.org/c/releases web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2022-38724.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-38724.yaml web
- https://www.silverstripe.org/blog/tag/release web
- https://www.silverstripe.org/download/security-releases web
- https://www.silverstripe.org/download/security-releases/cve-2022-38724 web