GHSA-v358-rvxr-wffxMedium

Silverstripe XSS Vulnerabilities

Published
May 17, 2022
Last Modified
January 12, 2024

🔗 CVE IDs covered (1)

CVE-2012-4968 →

📋 Description

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via

  1. a crafted string to the AbsoluteLinks
  2. BigSummary
  3. ContextSummary
  4. EscapeXML
  5. FirstParagraph
  6. FirstSentence
  7. Initial
  8. LimitCharacters
  9. LimitSentences
  10. LimitWordCount
  11. LimitWordCountXML
  12. Lower
  13. LowerCase
  14. NoHTML
  15. Summary
  16. Upper
  17. UpperCase, or
  18. URL method in a template,

different vectors than CVE-2012-0976.

🎯 Affected products2

  • composer/silverstripe/framework:>= 2.3, < 2.3.13
  • composer/silverstripe/framework:>= 2.4, < 2.4.7

🔗 References (9)