GHSA-2pw2-qpcp-m47x
Silverstripe CMS XSS Vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | silverstripe/cms | <= 4.5.0 | no fix listed |
| Packagist | silverstripe/framework | >= 3.0.0, < 3.7.5 | 3.7.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted login form URLs.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2020-9311
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2020-9311.yaml
- https://github.com/silverstripe/silverstripe-cms
- https://www.silverstripe.org/download/security-releases/CVE-2020-9311
- https://www.silverstripe.org/download/security-releases/cve-2020-9311