GHSA-mqf5-275h-gf6r
Suggest an improvement- Source
- https://github.com/advisories/GHSA-mqf5-275h-gf6r
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-mqf5-275h-gf6r/GHSA-mqf5-275h-gf6r.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-mqf5-275h-gf6r
- Published
- 2024-05-23T17:27:19Z
- Modified
- 2024-11-28T05:33:28.929622Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- Silverstripe framework is vulnerable to XSS in install.php
- Details
-
During installation, certain parameters (adminusername and adminpassword) are not escaped in the setup form.
This issue is resolved in 3.1.14 stable, although existing users are advised to remove this file prior to deploying to a production server.
- Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-79" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-05-23T17:27:19Z" }- References
-
- https://github.com/silverstripe/silverstripe-framework/commit/4c73721bab0d543eee6137e3c00aa8ec727e95d1
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-016-1.yaml
- https://github.com/silverstripe/silverstripe-framework
- https://www.silverstripe.org/software/download/security-releases/ss-2015-016
Affected packages
Packagist / silverstripe/framework
Package
- Name
- silverstripe/framework
- Purl
- pkg:composer/silverstripe/framework