PT-2023-22008 · Silverstripe · Silverstripe Form Capture

Tommcclymont · Published 2023-04-03 · Updated 2023-04-12 · CVE-2023-28851

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe Form Capture versions 0.2.0 through 1.0.1 Silverstripe Form Capture versions 1.1.1 through 2.2.4 Silverstripe Form Capture versions 3.1.0

Description The issue arises from improper escaping when presenting stored form submissions, allowing an attacker to perform a Cross-Site Scripting attack.

Recommendations For versions 0.2.0 through 1.0.1, update to version 1.0.2 or later. For versions 1.1.1 through 2.2.4, update to version 2.2.5 or later. For version 3.1.0, update to version 3.1.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2023-28851

GHSA-38H6-GMR2-J4WX

Affected Products

Silverstripe Form Capture

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28851.json · Exploit
• https://github.com/bigfork/silverstripe-form-capture/security/advisories/GHSA-38h6-gmr2-j4wx · Vendor Advisory
• https://github.com/bigfork/silverstripe-form-capture/commit/5b3aa39dd1eef042f173167b0fa4d3f717971772 · Patch
• https://osv.dev/vulnerability/GHSA-38h6-gmr2-j4wx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28851 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28851 · Vendor Advisory
• https://github.com/bigfork/silverstripe-form-capture · Note
• https://github.com/bigfork/silverstripe-form-capture/commit/3a7a3c480e3fccddce9c5f359796d45a8302a622 · Note
• https://t.me/cibsecurity/61349 · Telegram Post