PT-2024-40445 · Silverstripe · Silverstripe Cms

Published 2024-05-23 · Updated 2024-05-23

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe CMS (affected versions not specified)

Description A cross-site scripting issue has been found in the TreeDropdownField and TreeMultiSelectField. This can be exploited if a user with CMS access posts malicious or unescaped HTML into data objects used by these fields. The issue is resolved by safely encoding the content of data objects used as data sources.

Recommendations For the affected versions, ensure that all data objects used as a data source for the TreeDropdownField and TreeMultiSelectField have their content safely encoded to prevent exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-R32J-MR8P-HFP8

Affected Products

Silverstripe Cms

References · 5

• https://osv.dev/vulnerability/GHSA-r32j-mr8p-hfp8 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-004-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/89c14d079d3a130d6c4029af596262528ce53925 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/software/download/security-releases/ss-2015-004 · Note