PT-2024-40066 · Packagist · Silverstripe/Framework

Published 2024-05-27 · Updated 2024-05-27

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned.

Description The issue concerns lists of key/value pairs assigned to OptionsetField or CheckboxSetField that lack a default casting. This can lead to a potential XSS vulnerability when either the key or value contains unescaped HTML.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-468J-6JRC-2RJX

Affected Products

Silverstripe/Framework

References · 8

• https://osv.dev/vulnerability/GHSA-468j-6jrc-2rjx · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-015-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/b0ba2015d9684ee7b124dafcf6b59b046e20f8ed · Note
• https://github.com/silverstripe/silverstripe-framework/commit/62a242154ec3508fe9b174a40713c8520ac1684c · Note
• https://github.com/silverstripe/silverstripe-framework/commit/12a6b357e761f09d818fd0013eb2d85014de79a0 · Note
• https://github.com/silverstripe/silverstripe-framework/commit/049cdefacfd3122d59d5488c1317f999fe8aacc4 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2016-015 · Note