GitHub Advisoryadvisory · Packagist

GHSA-rppc-655v-7j3c Stored XSS in link tags added via XHR in SilverStripe Framework

MEDIUM Published 2022-06-29 Modified 2022-07-11 Official page ↗
Aliases
CVE-2022-28803
Ecosystem
Packagist
Packages
silverstripe/framework
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-06-29

Affected packages

• Packagist silverstripe/framework: >= 4.0.0, < 4.10.9 → fixed in 4.10.9

Description

SilverStripe Framework 4.x prior to 4.10.9 is vulnerable to cross-site scripting inside the href attribute of an HTML hyperlink, which can be added to website content via XMLHttpRequest (XHR) by an authenticated CMS user.

Related

Alias · CVE (1)

  • CVE-2022-28803 In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR). vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References