medium5.4
CVE-2022-28803
Stored XSS in link tags added via XHR in SilverStripe Framework
Impact
SilverStripe Framework 4.x prior to 4.10.9 is vulnerable to cross-site scripting inside the href attribute of an HTML hyperlink, which can be added to website content via XMLHttpRequest (XHR) by an authenticated CMS user.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | silverstripe/framework | >= 4.0.0, < 4.10.9 | 4.10.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Silverstripe | Silverstripe | before 4.10.9 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://silverstripe.org
- https://www.silverstripe.org/download/security-releases/cve-2022-28803
- https://github.com/advisories/GHSA-rppc-655v-7j3c
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-28803.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2022-28803