PT-2020-10136 · Silverstripe · Silverstripe

Ed Chipman · Published 2020-02-17 · Updated 2020-02-24 · CVE-2019-19325

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SilverStripe versions 4.4.x through 4.4.4 SilverStripe versions 4.5.x through 4.5.1

Description The issue allows Reflected XSS on the login form and custom forms. Silverstripe Forms permit malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, enabling XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input.

Recommendations For SilverStripe versions 4.4.x through 4.4.4, update to version 4.4.5 or later. For SilverStripe versions 4.5.x through 4.5.1, update to version 4.5.2 or later.

Exploit

Fix

XSS

OS Command Injection

Weakness Enumeration

CWE-79

CWE-78

Related Identifiers

CVE-2019-19325

GHSA-QVRV-2X7X-78X2

Affected Products

Silverstripe

References · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-19325.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2019-19325 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qvrv-2x7x-78x2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19325 · Security Note
• https://silverstripe.org/download/security-releases/cve-2019-19325 · Vendor Advisory
• https://github.com/silverstripe/silverstripe-framework/commit/49fda52b12ba59f0a04bcabf78425586a8779e89 · Note