Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
It is possible for a bad actor with access to the CMS to make use of onmouseover or onmouseout attributes in the WYSIWYG editor to embed malicious javascript.
Recommended action: Upgrade to 1.1.1 or 1.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users who don't have edit or delete permissions for records exposed in a ModelAdmin can still edit or delete records using the CSV import form, provided they have create permissions. The likelyhood of a user having create permissions but not having edit or delete permissions is low, but it is possible. Note that this doesn't affect any ModelAdmin which has had the import form disabled via the showImportForm public property, nor does it impact the SecurityAdmin section. Action may be required If you have a custom implementation of BulkLoader, you should update your implementation to respect permissions when the return value of getCheckPermissions() is true. If you are using any BulkLoader in your own project logic, or maintain a module which uses it, you should consider passing true to setCheckPermissions() if the data is provided by users. Base CVSS: 4.3 Reported by: Guy Sartorelli from Silverstripe References -…
Recommended action: Upgrade to 2.1.8 or 1.13.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin. Only Silverstripe CMS 4 is affected by these vulnerabilities. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin. Silverstripe CMS 5 is not affected by these vulnerabilities because it uses TinyMCE 6.
Recommended action: Upgrade to 1.13.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin. Only Silverstripe CMS 4 is affected by this issue. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin. Silverstripe CMS 5 is not affected by those vulnerabilities because it uses TinyMCE 6. You can find more information about the underlying vulnerabilities in those GitHub security advisories: - GHSA-5h9g-x5rv-25wg Cross-site scripting vulnerability in TinyMCE - GHSA-w7jx-j77m-wp65 Cross-site scripting vulnerability in TinyMCE
Recommended action: Upgrade to 1.13.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An old version of TinyMCE include an XSS vulnerability, which was patched in a later version. This was described by TinyMCE: A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower. We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS. Reported by: Developers at ACC
Recommended action: Upgrade to 1.12.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3).
Recommended action: Upgrade to 1.11.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SilverStripe versions 3.0.0 until 4.3.5 and 4.4.4 are vulnerable to Flash Clipboard Reflected XSS. Versions 4.3.5 and 4.4.4 of silverstripe/framework and version 1.3.5 of silverstripe/admin contain a fix for this issue.
Recommended action: Upgrade to 1.3.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Recommended action: Upgrade to 1.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.