GHSA-mpqj-f4v3-334h
GHSA-mpqj-f4v3-334h · Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
A cross-site scripting vulnerability in VersionedRequestFilter has been found. If an incoming user request should not be able to access the requested stage, an error message is created for display on the CMS login page that they are redirected to. In this error message, the URL of the requested page is interpolated into the error message without being escaped; hence, arbitrary HTML can be injected into the CMS login page.
CVSS 6.1 · Moyenne · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
silverstripe/framework Packagist
- Versions du logiciel
- 3.3.2
- 3.3.3-rc1
- 3.3.3-rc2
- Plages de versions concernées
- ECOSYSTEM: ≥ 3.3.2, < 3.3.3
Mettez à jour vers 3.3.3
silverstripe/framework Packagist
- Versions du logiciel
- 3.4.0
- 3.4.1-rc1
- 3.4.1-rc2
- Plages de versions concernées
- ECOSYSTEM: ≥ 3.4.0, < 3.4.1
Mettez à jour vers 3.4.1
Sources originales
- https://github.com/silverstripe/silverstripe-framework/commit/3fa84cf0c64a539d78600c36364817a8e38411d8
- https://github.com/silverstripe/silverstripe-framework/commit/41be95c95a55031412ee4056aeee5c2c69595836
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-007-1.yaml
- https://github.com/silverstripe/silverstripe-framework
- https://www.silverstripe.org/download/security-releases/ss-2016-007
- https://osv.dev/vulnerability/GHSA-mpqj-f4v3-334h