GitHub Advisoryadvisory · Packagist
GHSA-jx34-gqqq-r6gm Stored XSS via HTML fields in SilverStripe Framework
MEDIUM
Official page ↗
- Aliases
- CVE-2022-25238
- Ecosystem
- Packagist
- Packages
- silverstripe/framework
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2022-06-29
Affected packages
• Packagist silverstripe/framework: >= 4.0.0, < 4.10.9 → fixed in 4.10.9
Description
SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
Related
Alias · CVE (1)
- CVE-2022-25238 Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-25238 advisory
- https://docs.silverstripe.org/en/4/changelogs/4.10.1 web
- https://forum.silverstripe.org/c/releases web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-25238.yaml web
- https://www.silverstripe.org/blog/tag/release web
- https://www.silverstripe.org/download/security-releases web
- https://www.silverstripe.org/download/security-releases/cve-2022-25238 web