GitHub Advisoryadvisory · Packagist
GHSA-v358-rvxr-wffx Silverstripe XSS Vulnerabilities
MEDIUM
Official page ↗
- Aliases
- CVE-2012-4968
- Ecosystem
- Packagist
- Packages
- silverstripe/framework
- Severity
- Moderate
- Weaknesses
- CWE-79
- Reviewed
- 2024-01-12
Affected packages
• Packagist silverstripe/framework: >= 2.3, < 2.3.13 → fixed in 2.3.13
• Packagist silverstripe/framework: >= 2.4, < 2.4.7 → fixed in 2.4.7
Description
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via
1. a crafted string to the `AbsoluteLinks`
1. `BigSummary`
1. `ContextSummary`
1. `EscapeXML`
1. `FirstParagraph`
1. `FirstSentence`
1. `Initial`
1. `LimitCharacters`
1. `LimitSentences`
1. `LimitWordCount`
1. `LimitWordCountXML`
1. `Lower`
1. `LowerCase`
1. `NoHTML`
1. `Summary`
1. `Upper`
1. `UpperCase`, or
1. `URL` method in a template,
different vectors than CVE-2012-0976.
Related
Alias · CVE (1)
- CVE-2012-4968 Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2012-4968 advisory
- https://github.com/silverstripe/sapphire/commit/0085876 web
- https://github.com/silverstripe/silverstripe-framework/commit/0085876495f0f8dda5dc58cb24a8f2220e7baf1e web
- https://github.com/silverstripe/silverstripe-framework/commit/15e9e059e5948ccf8f5a36dfcb435ad26ecec334 web
- https://github.com/silverstripe/silverstripe-framework package
- http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13 web
- http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7 web
- http://www.openwall.com/lists/oss-security/2012/04/30/1 web
- http://www.openwall.com/lists/oss-security/2012/04/30/3 web