GitHub Advisoryadvisory · Packagist

GHSA-wc6r-4ggc-79w5 Stored XSS using HTMLEditor

MEDIUM Published 2022-11-21 Modified 2022-11-28 Official page ↗
Aliases
CVE-2022-37429
Ecosystem
Packagist
Packages
silverstripe/framework
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-11-21

Affected packages

• Packagist silverstripe/framework: >= 4.0.0, < 4.11.13 → fixed in 4.11.13

Description

A malicious content author could add a JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters. An attacker must have access to the CMS to exploit this issue.

Related

Alias · CVE (1)

  • CVE-2022-37429 Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References