GHSA-vv3r-fxqp-vr3f

Source

https://github.com/advisories/GHSA-vv3r-fxqp-vr3f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-vv3r-fxqp-vr3f/GHSA-vv3r-fxqp-vr3f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vv3r-fxqp-vr3f

Aliases

CVE-2022-38147

Published

2022-11-21T23:58:07Z

Modified

2024-02-20T05:31:49.434052Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

XSS via uploaded gpx file

Details

A malicious content author could upload a GPX file with a Javascript payload. The payload could then be executed by luring a legitimate user to view the file in a browser with support for GPX files. GPX is an XML-based format used to store GPS data.

By default, Silverstripe CMS will no longer allow GPX files to be uploaded to the assets area.

Database specific

{
    "nvd_published_at": "2022-11-23T03:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-21T23:58:07Z"
}

References

Affected packages

Packagist / silverstripe/assets

Package

Name: silverstripe/assets
Purl: pkg:composer/silverstripe/assets

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.0

Fixed

1.11.1

Affected versions

1.*

1.0.0

1.0.1-rc1

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.1.0-rc1

1.1.0-rc2

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.2.0-beta1

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.3.0-rc1

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.4.0-rc1

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.5.0-alpha1

1.5.0-rc1

1.5.0-rc2

1.5.0

1.5.1

1.5.2

1.5.3

1.6.0-beta1

1.6.0-rc1

1.6.0

1.6.1

1.7.0-beta1

1.7.0-rc1

1.7.0

1.7.1

1.8.0-beta1

1.8.0-rc1

1.8.0

1.9.0-alpha1

1.9.0-beta1

1.9.0-rc1

1.9.0

1.10.0-beta1

1.10.0-rc1

1.10.0

1.10.1

1.11.0-beta1

1.11.0-rc1

1.11.0