PT-2012-2982 · Silverstripe · Silverstripe

Chillu · Published 2012-02-02 · Updated 2017-08-29 · CVE-2012-0976

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SilverStripe version 2.4.6

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter in the admin/EditForm section.

Recommendations For SilverStripe version 2.4.6, consider restricting access to the admin/EditForm section to prevent exploitation until a fix is available. As a temporary workaround, avoid using the Title parameter in the affected section until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-0976

Affected Products

Silverstripe

References · 13

• 🔥 http://packetstormsecurity.org/files/view/109210/silverstripecmspage-xss.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-0976 · Security Note
• http://secunia.com/advisories/47812 · Vendor Advisory
• https://github.com/silverstripe/sapphire/commit/5fe7091 · Note
• https://github.com/silverstripe/sapphire/commit/475e077 · Note
• https://github.com/silverstripe/sapphire/commit/252e187 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0976 · Note
• http://osvdb.org/78677 · Note
• http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7 · Note
• http://openwall.com/lists/oss-security/2012/04/30/3 · Note
• http://securityfocus.com/bid/51761 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72820 · Note
• http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13 · Note