~ / search / GHSA-wg4m-vvp6-2hc5

GHSA-wg4m-vvp6-2hc5

SilverStripe vulnerable to Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Low CVE-2010-1593

Packages

EcosystemPackageAffectedFixed in
Packagist silverstripe/cms < 2.3.5 2.3.5
Packagist silverstripe/framework < 2.3.5 2.3.5

Details

As written in the advisory (Markdown source, shown as plain text).

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).

References

External links from the advisory. They lead to third-party sites.