PT-2024-40277 · Silverstripe · Cwp+4

Published 2024-05-27 · Updated 2024-05-27

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: silverstripe/comments module (affected versions not specified) cwp/starter-theme (affected versions not specified) cwp/watea-theme (affected versions not specified) SilverStripe 4 (versions prior to 4.2.0) CWP (versions prior to 2.0.0)

Description: The issue arises from the inclusion of an outdated version of jQuery, which contains XSS vulnerabilities when user input is used in certain contexts. Although no known exploit has been found in the existing usage, customizations to the themes could have made them exploitable.

Recommendations: For CWP versions prior to 2.0.0, update to CWP 2.0.0 to resolve the issue. For SilverStripe 4 versions prior to 4.2.0, update to SilverStripe 4.2.0 to resolve the issue. As a temporary workaround, consider restricting user customization to the cwp/starter-theme and cwp/watea-theme until a patch is available. Avoid using user input in certain contexts where the outdated jQuery version is used until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-FRM9-7PM9-5RGC

Affected Products

Cwp

Silverstripe 4

Cwp/Starter-Theme

Cwp/Watea-Theme

Silverstripe/Comments Module

References · 4

• https://osv.dev/vulnerability/GHSA-frm9-7pm9-5rgc · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/comments/SS-2018-015-1.yaml · Note
• https://github.com/silverstripe/silverstripe-comments · Note
• https://silverstripe.org/download/security-releases/ss-2018-015 · Note