CVE-2010-1593
CVE-2010-1593
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).
CVSS 5.3 · Medium · EPSS 2.6% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
silverstripe/cms Packagist
- Affected ranges
- ECOSYSTEM: < 2.3.5
Update to 2.3.5
silverstripe/framework Packagist
- Affected ranges
- ECOSYSTEM: < 2.3.5
Update to 2.3.5
Original sources
- http://www.silverstripe.org/security-releases/
- http://osvdb.org/61921
- http://secunia.com/advisories/38347
- http://osvdb.org/61923
- http://www.securityfocus.com/archive/1/509139/100/0/threaded
- http://open.silverstripe.org/wiki/ChangeLog/2.3.5
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55838
- http://www.securityfocus.com/bid/37923
- http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0450.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55839
- http://groups.google.com/group/silverstripe-announce/browse_thread/thread/f51749342eee9456
- http://open.silverstripe.org/changeset/97074
- http://secunia.com/advisories/38290
- https://nvd.nist.gov/vuln/detail/CVE-2010-1593