GHSA-xmjh-wjc5-wg4hMediumCVSS 6.1

Silverstripe CMS XSS Vulnerability

Published
May 14, 2022
Last Modified
August 9, 2023

🔗 CVE IDs covered (1)

CVE-2017-5197 →

📋 Description

There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element.

🎯 Affected products2

  • composer/silverstripe/cms:< 3.4.4
  • composer/silverstripe/cms:>= 3.5.0, < 3.5.2

🔗 References (4)