Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
12 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Page breadcrumbs in the CMS are vulnerable to XSS when viewed using the page list view Reporter Fase Rais Baradika
Recommended action: Upgrade to 6.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability exists in the permission validation for SiteTree object creation. By default user permissions are not validated by the SiteTree::canCreate method, unless overridden by user code or via the configuration system. This vulnerability will allow users, or unauthenticated guests, to create new SiteTree objects in the database. This vulnerability is present when such users are given CMS access via other means, or if there is another mechanism (such as RestfulServer module) which allows model editing and relies on model-level permission checks. This vulnerability is restricted to the creation of draft or live pages, and does not allow users to edit, publish, or unpublish existing pages. All users should upgrade as soon as possible.
Recommended action: Upgrade to 3.1.11 or 3.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site scripting vulnerability has been discovered in the VirtualPage class. This vulnerability can only be exploited if a user with CMS access has posted malicious or unescaped HTML into any of the textfields of a page which a VirtualPage refers to. This has been resolved by ensuring that VirtualPage safely escapes all field content.
Recommended action: Upgrade to 3.1.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site scripting vulnerability has been discovered in the CMS page history tab. This vulnerability can only be exploited if a user with CMS access has posted malicious or unescaped HTML into any of the text fields on a page, and if the "compare mode" option is selected. The HTML will be embedded into the page unescaped. This has been resolved by performing the text comparison in a HTML friendly way.
Recommended action: Upgrade to 3.1.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A malicious content author could create a custom meta tag and execute an arbitrary JavaScript payload. This would require convincing a legitimate user to access a page and enter a custom keyboard shortcut. This requires CMS access to exploit.
Recommended action: Upgrade to 4.11.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized.
Recommended action: Upgrade to 2.4.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.
Recommended action: Upgrade to 3.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.
Recommended action: Upgrade to 3.6.1 or 3.5.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).
Recommended action: Upgrade to 2.3.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element.
Recommended action: Upgrade to 3.5.2 or 3.4.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.0 before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.
Recommended action: Upgrade to 3.2.1 or 3.1.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.
Recommended action: Upgrade to 4.4.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.