PT-2023-32976 · Silverstripe · Silverstripe Cms

Published 2023-07-31 · Updated 2023-07-31

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe CMS version 4 TinyMCE versions 4.x

Description The issue concerns several XSS vectors in TinyMCE 4.x that have been patched in later versions. Two of these vectors affect the silverstripe/admin module. The security patches from later TinyMCE releases have been backported to the version bundled in silverstripe/admin to address the issue.

Recommendations For Silverstripe CMS version 4, apply the backported security patches to the TinyMCE version bundled in silverstripe/admin. For TinyMCE versions 4.x, consider upgrading to a later version that includes the security patches for the XSS vectors, if possible, or apply the necessary security patches.

Fix

Related Identifiers

GHSA-4Q66-G4MM-8RG5

Affected Products

Silverstripe Cms

References · 6

• https://osv.dev/vulnerability/GHSA-4q66-g4mm-8rg5 · Vendor Advisory
• https://github.com/silverstripe/silverstripe-admin/security/advisories/GHSA-4q66-g4mm-8rg5 · Note
• https://github.com/silverstripe/silverstripe-admin/commit/cafc1c4de58f1553b019dc2f8a62f835cabdbeb2 · Note
• https://github.com/silverstripe/silverstripe-admin · Note
• https://github.com/advisories/GHSA-w7jx-j77m-wp65 · Note
• https://github.com/advisories/GHSA-5h9g-x5rv-25wg · Note