PT-2024-40327 · Framework · Framework

Published 2024-05-23 · Updated 2024-05-23

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions framework versions prior to 3.1.14

Description A risk exists due to an unvalidated returnURL parameter passed to dev/build, which could cause the user to redirect to an unverified third-party URL outside of the site.

Recommendations For versions prior to 3.1.14, update to the 3.1.14 stable release to resolve the issue. As a temporary workaround, consider validating the returnURL parameter to ensure it does not redirect to unverified third-party URLs.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-HQ4P-5MPR-JJ9M

Affected Products

Framework

References · 5

• https://osv.dev/vulnerability/GHSA-hq4p-5mpr-jj9m · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-015-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/751d77386c3c6e354b521fa61ff142f95895cca8 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/software/download/security-releases/ss-2015-015 · Note