CVE-2022-25238

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-25238
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25238.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-25238
Aliases
Published
2022-06-28T21:39:48Z
Modified
2026-07-08T06:01:37.352837883Z
Summary
[none]
Details

Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code.

Database specific 
{
    "cna_assigner": "mitre",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "4.10.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25238.json"
}
References

Affected packages

Git / github.com/silverstripe/silverstripe-framework

Affected ranges

Type
GIT
Repo
https://github.com/silverstripe/silverstripe-framework
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e6c9136cd8747cb008ed914cd8714e6fe2b79825
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.10.0"
        }
    ],
    "cpe": "cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Affected versions

2.*
2.2.0-rc1
2.2.2-rc1
2.3.0-rc1
3.*
3.0.0-alpha1
3.0.0-alpha2
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-rc1
4.*
4.0.0-alpha1
4.0.0-alpha2
4.0.0-alpha3
4.0.0-alpha4
4.0.0-alpha6
4.0.0-alpha7
4.0.0-beta1
4.0.0-beta2
4.0.0-beta3
4.1.0-rc1
4.10.0
4.10.0-beta1
4.6.0-beta1
4.7.0-beta1
4.8.0-beta1
4.9.0-alpha1
4.9.0-beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25238.json"