PT-2012-2982 · Silverstripe · Silverstripe

Chillu · Publicado 2012-02-02 · Atualizado 2017-08-29 · CVE-2012-0976

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SilverStripe version 2.4.6

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter in the admin/EditForm section.

Recommendations For SilverStripe version 2.4.6, consider restricting access to the admin/EditForm section to prevent exploitation until a fix is available. As a temporary workaround, avoid using the Title parameter in the affected section until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-0976

Produtos afetados

Silverstripe

Referências · 13

• 🔥 http://packetstormsecurity.org/files/view/109210/silverstripecmspage-xss.txt · Exploit
• https://github.com/silverstripe/sapphire/commit/5fe7091 · Nota
• https://github.com/silverstripe/sapphire/commit/475e077 · Nota
• https://github.com/silverstripe/sapphire/commit/252e187 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-0976 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0976 · Nota
• http://osvdb.org/78677 · Nota
• http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7 · Nota
• http://openwall.com/lists/oss-security/2012/04/30/3 · Nota
• http://securityfocus.com/bid/51761 · Nota
• http://secunia.com/advisories/47812 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72820 · Nota
• http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13 · Nota