PT-2023-22008 · Silverstripe · Silverstripe Form Capture

Tommcclymont · Publicado 2023-04-03 · Atualizado 2023-04-12 · CVE-2023-28851

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe Form Capture versions 0.2.0 through 1.0.1 Silverstripe Form Capture versions 1.1.1 through 2.2.4 Silverstripe Form Capture versions 3.1.0

Description The issue arises from improper escaping when presenting stored form submissions, allowing an attacker to perform a Cross-Site Scripting attack.

Recommendations For versions 0.2.0 through 1.0.1, update to version 1.0.2 or later. For versions 1.1.1 through 2.2.4, update to version 2.2.5 or later. For version 3.1.0, update to version 3.1.1 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-80

CWE-79

Identificadores relacionados

CVE-2023-28851

GHSA-38H6-GMR2-J4WX

Produtos afetados

Silverstripe Form Capture

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28851.json · Exploit
• https://github.com/bigfork/silverstripe-form-capture/security/advisories/GHSA-38h6-gmr2-j4wx · Aviso do Fabricante
• https://github.com/bigfork/silverstripe-form-capture/commit/5b3aa39dd1eef042f173167b0fa4d3f717971772 · Correção
• https://github.com/bigfork/silverstripe-form-capture · Nota
• https://github.com/bigfork/silverstripe-form-capture/commit/3a7a3c480e3fccddce9c5f359796d45a8302a622 · Nota
• https://osv.dev/vulnerability/GHSA-38h6-gmr2-j4wx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-28851 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-28851 · Aviso do Fabricante
• https://t.me/cibsecurity/61349 · Publicação no Telegram