PT-2023-33041 · Silverstripe · Silverstripe Cms

Publicado 2023-08-23 · Atualizado 2023-08-23

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Silverstripe CMS version 4 TinyMCE versions 4.x

Description The issue concerns several XSS vectors in TinyMCE 4.x that have been patched in later versions. These vulnerabilities affect silverstripe/admin and, by extension, Silverstripe CMS 4. It is noted that Silverstripe CMS 5 is not affected due to its use of TinyMCE 6.

Recommendations For Silverstripe CMS version 4, apply the backported security patches to the TinyMCE version bundled in silverstripe/admin. For TinyMCE versions 4.x, consider upgrading to a later version where these XSS vectors have been patched, if possible without introducing breaking changes.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

GHSA-JXCX-3H54-QQXX

Produtos afetados

Silverstripe Cms

Referências · 4

• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/admin/SS-2023-002.yaml · Nota
• https://github.com/silverstripe/silverstripe-admin · Nota
• https://silverstripe.org/download/security-releases/SS-2023-002 · Nota
• https://osv.dev/vulnerability/GHSA-jxcx-3h54-qqxx · Aviso do Fabricante