PT-2024-40380 · Softwarex · Softwarex

Published 2024-05-23 · Updated 2024-05-23

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 3.1.14

Description The issue arises during installation, where certain parameters (admin username and admin password) are not properly escaped in the setup form.

Recommendations For versions prior to 3.1.14, update to version 3.1.14 or later and remove the specified file prior to deploying to a production server.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-MQF5-275H-GF6R

Affected Products

Softwarex

References · 5

• https://osv.dev/vulnerability/GHSA-mqf5-275h-gf6r · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-016-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/4c73721bab0d543eee6137e3c00aa8ec727e95d1 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/software/download/security-releases/ss-2015-016 · Note