PT-2022-23986 · Silverstripe · Silverstripe Cms

Tf1T · Published 2022-11-21 · Updated 2024-03-06 · CVE-2022-37421

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe silverstripe/cms versions 4.11.0 and earlier

Description The issue allows for XSS (Cross-Site Scripting) attacks. A malicious content author could create a custom meta tag and execute an arbitrary JavaScript payload. This would require convincing a legitimate user to access a page and enter a custom keyboard shortcut, and it requires CMS access to exploit.

Recommendations For versions 4.11.0 and earlier, as a temporary workaround, consider restricting access to custom meta tags until a patch is available. Restrict CMS access to minimize the risk of exploitation. Avoid using custom keyboard shortcuts in the affected CMS until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-SILVERSTRIPE-2022-37421

CVE-2022-37421

GHSA-PP74-G2Q5-J4JF

Affected Products

Silverstripe Cms

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/cms/CVE-2022-37421.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2022-37421 · Vendor Advisory
• https://silverstripe.org/download/security-releases/CVE-2022-37421 · Vendor Advisory
• https://forum.silverstripe.org/c/releases · Vendor Advisory
• https://silverstripe.org/download/security-releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37421 · Security Note
• https://silverstripe.org/blog/tag/release · Vendor Advisory
• https://osv.dev/vulnerability/BIT-silverstripe-2022-37421 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pp74-g2q5-j4jf · Vendor Advisory
• https://t.me/cibsecurity/53389 · Telegram Post
• https://silverstripe.org/download/security-releases/cve-2022-37421 · Note