PT-2024-40027 · Silverstripe · Silverstripe Cms

Published 2024-05-23 · Updated 2024-05-23

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe CMS (affected versions not specified)

Description The issue concerns insufficient CSRF protection in GridField, which can be exploited to trick users with CMS access into posting unspecified data from external websites. This affects the management of groups, users, and permissions in the CMS.

Recommendations For the affected versions, ensure that all gridFieldAlterAction submissions are checked for the SecurityID token during submission.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

GHSA-2HPC-MF4Q-J885

Affected Products

Silverstripe Cms

References · 7

• https://osv.dev/vulnerability/GHSA-2hpc-mf4q-j885 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-002-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/56e92f5a32e45849cc9361c8603c31d7010c9d36 · Note
• https://github.com/silverstripe/silverstripe-framework/commit/e2c77c5a8f13e901c51a3684210811559b592f0c · Note
• https://github.com/silverstripe/silverstripe-framework/commit/013524af5069bb0cf909853f04418d9bef56d18c · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2016-002 · Note