p PatchFirst

GHSA-4q66-g4mm-8rg5

GHSA-4q66-g4mm-8rg5 · Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting `silverstripe/admin`. Only Silverstripe CMS 4 is affected by this issue. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in `silverstripe/admin`. Silverstripe CMS 5 is not affected by those vulnerabilities because it uses TinyMCE 6. You can find more information about the underlying vulnerabilities in those GitHub security advisories: - [GHSA-5h9g-x5rv-25wg Cross-site scripting vulnerability in TinyMCE](https://github.com/advisories/GHSA-5h9g-x5rv-25wg) - [GHSA-w7jx-j77m-wp65 Cross-site scripting vulnerability in TinyMCE](https://github.com/advisories/GHSA-w7jx-j77m-wp65)

CVSS 5.4 · Mittel · Korrektur verfügbar

Veröffentlicht
Aktualisiert

Technologie-Stack: php

Betroffene Produkte und Versionen

  • silverstripe/admin Packagist

    Softwareversionen
    • 1.0.0
    • 1.0.0-alpha6
    • 1.0.0-alpha7
    • 1.0.0-beta1
    • 1.0.0-beta2
    • 1.0.0-beta3
    • 1.0.0-beta4
    • 1.0.0-rc1
    • 1.0.0-rc2
    • 1.0.0-rc3
    • 1.0.1
    • 1.0.1-rc1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.1.0
    • 1.1.0-rc1
    • 1.1.0-rc2
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.1.5
    • 1.10.0
    • 1.10.0-beta1
    • 1.10.0-rc1
    • 1.10.1
    • 1.10.2
    • 1.10.3
    • 1.10.4
    • 1.11.0
    • 1.11.0-beta1
    • 1.11.0-rc1
    • 1.11.1
    • 1.11.2
    • 1.11.3
    • 1.12.0
    • 1.12.0-beta1
    • 1.12.0-rc1
    • 1.12.1
    • 1.12.2
    • 1.12.3
    • 1.12.4
    • 1.12.5
    • 1.12.6
    • 1.12.7
    • 1.13.0
    • 1.13.0-beta1
    • 1.13.0-rc1
    • 1.13.1
    • 1.13.2
    • 1.13.3
    • 1.13.4
    • 1.13.5
    • 1.2.0
    • 1.2.0-beta1
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 1.2.4
    • 1.2.5
    • 1.2.6
    • 1.3.0
    • 1.3.0-rc1
    • 1.3.1
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.3.5
    • 1.4.0
    • 1.4.0-rc1
    • 1.4.1
    • 1.4.2
    • 1.4.3
    • 1.4.4
    • 1.4.5
    • 1.5.0
    • 1.5.0-alpha1
    • 1.5.0-rc1
    • 1.5.0-rc2
    • 1.5.1
    • 1.5.2
    • 1.6.0
    • 1.6.0-beta1
    • 1.6.0-rc1
    • 1.6.1
    • 1.6.2
    • 1.6.3
    • 1.6.4
    • 1.7.0
    • 1.7.0-beta1
    • 1.7.0-rc1
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.7.4
    • 1.8.0
    • 1.8.0-beta1
    • 1.8.0-rc1
    • 1.8.1
    • 1.9.0
    • 1.9.0-alpha1
    • 1.9.0-beta1
    • 1.9.0-rc1
    Betroffene Versionsbereiche
    • ECOSYSTEM: < 1.13.6

    Auf 1.13.6 aktualisieren

Originalquellen

Prüfen Sie Ihren Server →