PT-2022-19248 · Silverstripe · Silverstripe/Framework

Ranjit-Git · Published 2022-06-29 · Updated 2024-03-06 · CVE-2022-28803

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SilverStripe Framework versions prior to 4.10.9 SilverStripe Framework through 2022-04-07

Description The issue allows for Stored XSS to occur in javascript link tags added via XMLHttpRequest (XHR). This can happen when an authenticated CMS user adds malicious content to a website via XHR, specifically inside the href attribute of an HTML hyperlink.

Recommendations For SilverStripe Framework versions prior to 4.10.9, update to version 4.10.9 or later to resolve the issue. For SilverStripe Framework through 2022-04-07, ensure that all updates up to 2022-04-07 are applied to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the XHR functionality for authenticated CMS users until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-SILVERSTRIPE-2022-28803

CVE-2022-28803

GHSA-RPPC-655V-7J3C

Affected Products

Silverstripe/Framework

References · 7

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-28803.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-28803 · Security Note
• https://silverstripe.org/download/security-releases/cve-2022-28803 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rppc-655v-7j3c · Vendor Advisory
• https://osv.dev/vulnerability/BIT-silverstripe-2022-28803 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28803 · Vendor Advisory
• https://silverstripe.org · Note