p PatchFirst

CVE-2019-19325

CVE-2019-19325

This page contains facts from public vulnerability sources. Check the original advisory before updating.

SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input.

CVSS 6.1 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • silverstripe/framework Packagist

    Versions
    • 4.5.0
    • 4.5.1
    Affected ranges
    • ECOSYSTEM: ≥ 4.5.0, < 4.5.2

    Update to 4.5.2

  • silverstripe/framework Packagist

    Versions
    • 4.0.0
    • 4.0.1
    • 4.0.1-rc1
    • 4.0.2
    • 4.0.3
    • 4.0.4
    • 4.0.5
    • 4.0.6
    • 4.0.7
    • 4.1.0
    • 4.1.0-rc1
    • 4.1.0-rc2
    • 4.1.1
    • 4.1.2
    • 4.1.3
    • 4.1.4
    • 4.1.5
    • 4.2.0
    • 4.2.0-beta1
    • 4.2.1
    • 4.2.2
    • 4.2.3
    • 4.2.4
    • 4.2.5
    • 4.3.0
    • 4.3.0-rc1
    • 4.3.1
    • 4.3.2
    • 4.3.3
    • 4.3.4
    • 4.3.5
    • 4.4.0
    • 4.4.0-rc1
    • 4.4.1
    • 4.4.2
    • 4.4.3
    • 4.4.4
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, < 4.4.5

    Update to 4.4.5

Original sources

Check your server →