GitHub Advisoryadvisory · Packagist

GHSA-gv6c-59h4-9pmg Silverstripe CMS Arbitrary Code Execution

MEDIUM Published 2022-05-17 Modified 2024-01-19 Official page ↗
Aliases
CVE-2011-4962
Ecosystem
Packagist
Packages
silverstripe/cms
Severity
Moderate
Weaknesses
CWE-20, CWE-502
Reviewed
2024-01-19

Affected packages

• Packagist silverstripe/cms: >= 2.4.0, < 2.4.6 → fixed in 2.4.6

Description

`code/sitefeatures/PageCommentInterface.php` in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized.

Related

Alias · CVE (1)

  • CVE-2011-4962 code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References