GHSA-qw4w-vq8v-2wcv

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-qw4w-vq8v-2wcv/GHSA-qw4w-vq8v-2wcv.json
Aliases
  • CVE-2022-37430
Published
2022-11-21T23:59:38Z
Modified
2022-11-23T17:54:57.971940Z
Details

A malicious content author could add a Javascript payload to the href attribute of a link. A similar issue was identified and fixed via CVE-2022-28803. However, the fix didn't account for the casing of the href attribute. An attacker must have access to the CMS to exploit this issue.

References

Affected packages

Packagist / silverstripe/framework

silverstripe/framework

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.11.13

Affected versions

4.*

4.0.0
4.0.1
4.0.1-rc1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.1.0
4.1.0-rc1
4.1.0-rc2
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.10.0
4.10.0-beta1
4.10.0-rc1
4.10.1
4.10.10
4.10.11
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.11.0-beta1
4.11.0-beta2
4.11.0-beta3
4.11.0-rc1
4.11.1
4.11.10
4.11.11
4.11.12
4.11.2
4.11.3
4.11.4
4.11.5
4.11.6
4.11.7
4.11.8
4.11.9
4.2.0
4.2.0-beta1
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.0-rc1
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.4.0
4.4.0-rc1
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.5.0
4.5.0-alpha1
4.5.0-rc1
4.5.0-rc2
4.5.1
4.5.2
4.5.3
4.5.4
4.6.0
4.6.0-beta1
4.6.0-rc1
4.6.1
4.6.2
4.7.0
4.7.0-beta1
4.7.0-rc1
4.7.1
4.7.2
4.7.3
4.7.4
4.8.0
4.8.0-beta1
4.8.0-rc1
4.8.1
4.9.0
4.9.0-alpha1
4.9.0-beta1
4.9.0-rc1
4.9.1
4.9.2
4.9.3
4.9.4