PT-2024-40342 · Packagist · Silverstripe/Framework

Published 2024-05-23 · Updated 2024-05-23

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned.

Description A high-level XSS risk has been identified in the encoding of validation messages in certain FormField classes. This issue affects form fields that present invalid content as part of their validation response, with specific examples including NumericField and DropdownField.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-J982-5JV7-V43R

Affected Products

Silverstripe/Framework

References · 6

• https://osv.dev/vulnerability/GHSA-j982-5jv7-v43r · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-026-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/bc1b2893accba6401c03f9ea3b0cbc4621c7a02c · Note
• https://github.com/silverstripe/silverstripe-framework/commit/245e0aae2f5f3eb0acba1d198ad8e196bb224462 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2015-026 · Note