PT-2025-5641 · Silverstripe · Silverstripe

Published 2025-01-14 · Updated 2025-01-14

Positive Technologies (AI Summary)

CVSS v3.1

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Silverstripe (affected versions not specified)

Description: The issue affects sites in the "dev" environment mode, allowing an XSS payload to be executed in the resulting error message when a specifically crafted URL is provided. This is a misconfiguration issue, as production websites should not be in "dev" mode.

Recommendations: Immediately switch production websites from "dev" mode to "live" mode to prevent exploitation. As a temporary workaround, consider restricting access to the website while it is in "dev" mode to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-MQF3-QPC3-G26Q

Affected Products

Silverstripe

References · 5

• https://osv.dev/vulnerability/GHSA-mqf3-qpc3-g26q · Vendor Advisory
• https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-mqf3-qpc3-g26q · Note
• https://github.com/silverstripe/silverstripe-framework/commit/a555dad4ec73c929f6316bcb4019eb325a5b77d8 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2024-002 · Note