Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
89 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS.
Recommended action: Upgrade to 4.4.4 or 4.3.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SilverStripe versions 3.0.0 until 4.3.5 and 4.4.4 are vulnerable to Flash Clipboard Reflected XSS. Versions 4.3.5 and 4.4.4 of silverstripe/framework and version 1.3.5 of silverstripe/admin contain a fix for this issue.
Recommended action: Upgrade to 4.4.4 or 4.3.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via 1. a crafted string to the AbsoluteLinks 1. BigSummary 1. ContextSummary 1. EscapeXML 1. FirstParagraph 1. FirstSentence 1. Initial 1. LimitCharacters 1. LimitSentences 1. LimitWordCount 1. LimitWordCountXML 1. Lower 1. LowerCase 1. NoHTML 1. Summary 1. Upper 1. UpperCase, or 1. URL method in a template, different vectors than CVE-2012-0976.
Recommended action: Upgrade to 2.4.7 or 2.3.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, which may be executed if imported without sanitization into common software (including Microsoft Excel). For example, the CSV data may contain untrusted user input from the "First Name" field of a user's /myprofile page.
Recommended action: Upgrade to 4.0.1, 3.6.3 or 3.5.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).
Recommended action: Upgrade to 2.3.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.6.74.1.54.3.14.2.44.0.73.7.3· Vendor fix available
Issue
All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows Reflected SQL Injection through Form and DataObject.
Recommended action: Upgrade to 4.3.1, 4.2.4, 4.1.5 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
FileField with array notation skips validation The FileField class is commonly used for file upload in custom code on a Silverstripe website. This field is designed to be used with a single file upload. PHP allows for submitting multiple values by adding square brackets to the field name. When this is done to a FileField, it will be coerced into allowing multiple files by using this notation. This is not a supported feature, though nothing is done to prevent this. In this scenario, validation such as limiting allowed extensions is not applied, and the FileField-saveInto() behaviour is not triggered. If custom controller logic is used to process the file uploads, it might implicitly rely on validation to be provided by the Form system, which is not the case.
Recommended action: Upgrade to 4.7.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SilverStripe Framework prior to version 4.10.1 is vulnerable to business logic errors.
Recommended action: Upgrade to 4.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In SilverStripe assets 4.0, there is broken access control on files.
Recommended action: Upgrade to 4.4.4 or 4.3.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input.
Recommended action: Upgrade to 4.5.2 or 4.4.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.
Recommended action: Upgrade to 4.4.4 or 4.3.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.
Recommended action: Upgrade to 4.4.4, 4.3.6, 3.7.4 or 3.6.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SilverStripe through 4.3.3 allows session fixation in the "change password" form.
Recommended action: Upgrade to 4.4.4, 4.3.5, 3.7.4 or 3.6.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.
Recommended action: Upgrade to 4.3.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.