Описание
Silverstripe XSS in shortcodes
A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used to inject a JavaScript payload on the front end of the site. The shortcode providers that ship with Silverstripe CMS have been reviewed and attribute whitelists have been implemented where appropriate to negate this risk.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2022-38724
- https://forum.silverstripe.org/c/releases
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2022-38724.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-38724.yaml
- https://www.silverstripe.org/blog/tag/release
- https://www.silverstripe.org/download/security-releases
- https://www.silverstripe.org/download/security-releases/cve-2022-38724
Пакеты
Наименование
silverstripe/assets
composer
Затронутые версииВерсия исправления
>= 1.0.0, < 1.11.1
1.11.1
Наименование
silverstripe/framework
composer
Затронутые версииВерсия исправления
>= 4.0.0, < 4.11.13
4.11.13
Связанные уязвимости
CVSS3: 5.4
nvd
около 3 лет назад
Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS.