GitHub Advisoryadvisory · Packagist

GHSA-wg4m-vvp6-2hc5 SilverStripe vulnerable to Cross-site Scripting

LOW Published 2022-05-14 Modified 2025-04-11 Official page ↗
Aliases
CVE-2010-1593
Ecosystem
Packagist
Packages
silverstripe/cms, silverstripe/framework
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
Weaknesses
CWE-79
Reviewed
2025-04-11

Affected packages

• Packagist silverstripe/cms: < 2.3.5 → fixed in 2.3.5 • Packagist silverstripe/framework: < 2.3.5 → fixed in 2.3.5

Description

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).

Related

Alias · CVE (1)

  • CVE-2010-1593 Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References