Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

symbiote/silverstripe-queuedjobs

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedPackagistPublished

    XSS in CreateQueuedJobTask

    CVE-2021-27938 · GHSA-xgpf-p52j-pf7m

    Affected
    • Packagist symbiote/silverstripe-queuedjobs >= 3.0.0, < 3.0.2; >= 3.1.0, < 3.1.4; >= 4.0.0, < 4.0.7; >= 4.1.0, < 4.1.2; >= 4.2.0, < 4.2.4; >= 4.3.0, < 4.3.3; >= 4.4.0, < 4.4.3; >= 4.5.0, < 4.5.1; >= 4.6.0, < 4.6.4
    Fixed in
    4.5.13.0.24.1.24.2.44.0.74.4.34.3.33.1.44.6.4· Vendor fix available
    Issue
    A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL.

    Recommended action: Upgrade to 4.6.4, 4.5.1, 4.4.3 or 6 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →