GHSA-9cx2-hj6m-fv58
Silverstripe XSS in shortcodes
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | silverstripe/assets | >= 1.0.0, < 1.11.1 | 1.11.1 |
| Packagist | silverstripe/framework | >= 4.0.0, < 4.11.13 | 4.11.13 |
Details
As written in the advisory (Markdown source, shown as plain text).
A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used to inject a JavaScript payload on the front end of the site. The shortcode providers that ship with Silverstripe CMS have been reviewed and attribute whitelists have been implemented where appropriate to negate this risk.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-38724
- https://forum.silverstripe.org/c/releases
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2022-38724.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-38724.yaml
- https://www.silverstripe.org/blog/tag/release
- https://www.silverstripe.org/download/security-releases
- https://www.silverstripe.org/download/security-releases/cve-2022-38724