GHSA-rppc-655v-7j3cMediumCVSS 5.4

Stored XSS in link tags added via XHR in SilverStripe Framework

Published
June 29, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-28803 →

📋 Description

SilverStripe Framework 4.x prior to 4.10.9 is vulnerable to cross-site scripting inside the href attribute of an HTML hyperlink, which can be added to website content via XMLHttpRequest (XHR) by an authenticated CMS user.

🎯 Affected products1

  • composer/silverstripe/framework:>= 4.0.0, < 4.10.9

🔗 References (4)