PT-2023-33041 · Silverstripe · Silverstripe Cms

Published 2023-08-23 · Updated 2023-08-23

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Silverstripe CMS version 4 TinyMCE versions 4.x

Description The issue concerns several XSS vectors in TinyMCE 4.x that have been patched in later versions. These vulnerabilities affect silverstripe/admin and, by extension, Silverstripe CMS 4. It is noted that Silverstripe CMS 5 is not affected due to its use of TinyMCE 6.

Recommendations For Silverstripe CMS version 4, apply the backported security patches to the TinyMCE version bundled in silverstripe/admin. For TinyMCE versions 4.x, consider upgrading to a later version where these XSS vectors have been patched, if possible without introducing breaking changes.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-JXCX-3H54-QQXX

Affected Products

Silverstripe Cms

References · 4

• https://osv.dev/vulnerability/GHSA-jxcx-3h54-qqxx · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/admin/SS-2023-002.yaml · Note
• https://github.com/silverstripe/silverstripe-admin · Note
• https://silverstripe.org/download/security-releases/SS-2023-002 · Note