medium5.4
CVE-2022-25238
Stored XSS via HTML fields in SilverStripe Framework
Impact
SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | silverstripe/framework | >= 4.0.0, < 4.10.9 | 4.10.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Silverstripe | Framework | through 4.10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://docs.silverstripe.org/en/4/changelogs/4.10.1/
- https://forum.silverstripe.org/c/releases
- https://www.silverstripe.org/blog/tag/release
- https://www.silverstripe.org/download/security-releases/
- https://github.com/advisories/GHSA-jx34-gqqq-r6gm
- https://nvd.nist.gov/vuln/detail/CVE-2022-25238
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-25238.yaml
- https://www.silverstripe.org/download/security-releases/cve-2022-25238