PT-2022-24417 · Silverstripe · Silverstripe/Framework

Published 2022-11-21 · Updated 2025-04-29 · CVE-2022-38462

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe silverstripe/framework versions 4.11 and earlier

Description The issue allows an attacker to inject a XSS payload in a Silverstripe CMS response by carefully crafting a return URL on a "/dev/build" or "/Security/login" request. To exploit this, an attacker would need to convince a user to follow a link with a malicious payload. This vulnerability will only affect projects configured to output PHP warnings to the browser, which is the case when the SS ENVIRONMENT TYPE environment variable is set to 'dev'. Production sites, which should have SS ENVIRONMENT TYPE set to 'live', are not affected in the same way.

Recommendations For versions 4.11 and earlier, consider setting the SS ENVIRONMENT TYPE environment variable to 'live' to prevent PHP warnings from being output to the browser, thereby minimizing the risk of exploitation. As a temporary workaround, restrict access to the "/dev/build" and "/Security/login" API endpoints until a patch is available. Avoid using these endpoints in production environments until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-38462

GHSA-VVXF-R4VM-2VM6

Affected Products

Silverstripe/Framework

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-38462.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-38462 · Security Note
• https://silverstripe.org/blog/tag/release · Vendor Advisory
• https://forum.silverstripe.org/c/releases · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38462 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vvxf-r4vm-2vm6 · Vendor Advisory
• https://silverstripe.org/download/security-releases · Vendor Advisory
• https://silverstripe.org/download/security-releases/cve-2022-38462 · Note
• https://t.me/cvenotify/38217 · Telegram Post
• https://t.me/cibsecurity/53333 · Telegram Post
• https://t.me/cvenotify/120135 · Telegram Post