GitHub Advisoryadvisory · Packagist

GHSA-jqp8-v74p-g8px Silverstripe XSS in Director::force_redirect()

MEDIUM Published 2024-05-23 Modified 2024-05-23 Official page ↗
Ecosystem
Packagist
Packages
silverstripe/framework
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-05-23

Affected packages

• Packagist silverstripe/framework: >= 3.1.0, < 3.1.12 → fixed in 3.1.12

Description

A low level XSS vulnerability has been found in the Framework affecting http redirection via the Director::force_redirect method. Attempts to redirect to a url may generate HTML which is not safely escaped, and may pose a risk of XSS in some environments. This vulnerability is marked low as it is difficult to exploit, as any injected HTML will only be returned from the server if the Location HTTP header is also sent, meaning that any user browsing the site would not be exposed to the body of the response before their browser redirects them.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References