GitHub Advisoryadvisory · Packagist

GHSA-qvrv-2x7x-78x2 Reflected XSS in SilverStripe

MEDIUM Published 2020-02-24 Modified 2024-02-06 Official page ↗
Aliases
CVE-2019-19325
Ecosystem
Packagist
Packages
silverstripe/framework
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-78, CWE-79
Reviewed
2020-02-18

Affected packages

• Packagist silverstripe/framework: >= 4.5.0, < 4.5.2 → fixed in 4.5.2 • Packagist silverstripe/framework: >= 4.0.0, < 4.4.5 → fixed in 4.4.5

Description

SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user&amp;#39;s credentials or other sensitive user input.

Related

Alias · CVE (1)

  • CVE-2019-19325 SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. vulnerability

Weakness · CWE (2)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References