PT-2022-24544 · Silverstripe · Silverstripe/Framework+2

Steve Boyd · Published 2022-11-21 · Updated 2025-04-29 · CVE-2022-38724

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe silverstripe/framework versions 4.11.0 and earlier Silverstripe silverstripe/assets versions 1.11.0 and earlier Silverstripe silverstripe/asset-admin versions 1.11.0 and earlier

Description The issue allows for cross-site scripting (XSS) attacks. A malicious content author could add arbitrary attributes to HTML editor shortcodes, potentially injecting a JavaScript payload on the site's front end. The shortcode providers that ship with Silverstripe CMS have been reviewed, and attribute whitelists have been implemented where necessary to mitigate this risk.

Recommendations For silverstripe/framework versions 4.11.0 and earlier, update to a version that includes the attribute whitelists for shortcode providers. For silverstripe/assets versions 1.11.0 and earlier, update to a version that includes the attribute whitelists for shortcode providers. For silverstripe/asset-admin versions 1.11.0 and earlier, update to a version that includes the attribute whitelists for shortcode providers. As a temporary workaround, consider restricting the ability to add arbitrary attributes to HTML editor shortcodes until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-38724

GHSA-9CX2-HJ6M-FV58

Affected Products

Silverstripe Asset-Admin

Silverstripe/Assets

Silverstripe/Framework

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2022-38724.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-38724.yaml · Exploit
• 🔥 https://silverstripe.org/download/security-releases · Exploit
• https://silverstripe.org/blog/tag/release · Vendor Advisory
• https://forum.silverstripe.org/c/releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38724 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38724 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9cx2-hj6m-fv58 · Vendor Advisory
• https://silverstripe.org/download/security-releases/CVE-2022-38724 · Vendor Advisory
• https://silverstripe.org/download/security-releases/cve-2022-38724 · Note
• https://t.me/cvenotify/38578 · Telegram Post
• https://t.me/cvenotify/38281 · Telegram Post
• https://t.me/cvenotify/120144 · Telegram Post