silverstripe/framework vulnerabilities

Silverstripe Framework: Possible XSS attack through media embed

Affected

<6.2.2

Fixed in

6.2.2

Silverstripe Framework user enumeration via timing attack on login and password reset forms

Affected

>=4.0.0 <5.3.23

Fixed in

5.3.23

Silverstripe Framework has a XSS vulnerability in HTML editor

Affected

<5.3.23

Fixed in

5.3.23

Reflected Cross Site Scripting (XSS) in error message

Affected

<5.3.8

Fixed in

5.3.8

Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message

Affected

<5.3.8

Fixed in

5.3.8

Silverstripe Framework has a XSS in form messages

Affected

<5.3.8

Fixed in

5.3.8

Silverstripe Framework has a XSS via insert media remote file oembed

Affected

<5.3.8

Fixed in

5.3.8

Silverstripe uses TinyMCE which allows svg files linked in object tags

Affected

<5.2.16

Fixed in

5.2.16

Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload

Affected

<5.2.16

Fixed in

5.2.16

silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector

Affected

>=4.0.0-rc1 <4.0.6 · >=4.1.0-rc1 <4.1.4 · >=4.2.0-rc1 <4.2.3

Fixed in

4.0.6, 4.1.4, 4.2.3

silverstripe/framework has possible denial of service attack vector when flushing

Affected

>=4.0.0-rc1 <4.0.5 · >=4.1.0-rc1 <4.1.3 · >=4.2.0-rc1 <4.2.2

Fixed in

4.0.5, 4.1.3, 4.2.2

silverstripe/framework may disclose database credentials during connection failure

Affected

>=3.7.0-rc1 <3.7.1 · >=4.0.0-rc1 <4.0.5 · >=4.1.0-rc1 <4.1.3 · >=4.2.0-rc1 <4.2.2

Fixed in

3.7.1, 4.0.5, 4.1.3, 4.2.2

silverstripe/framework allows upload of dangerous file types

Affected

>=3.6.5-rc1 <3.6.6 · >=4.0.3-rc1 <4.0.4 · >=4.1.0-rc1 <4.1.1

Fixed in

3.6.6, 4.0.4, 4.1.1

silverstripe/framework vulnerable to member disclosure in login form

Affected

>=4.0.0-rc1 <4.0.4 · >=4.1.0-rc1 <4.1.1

Fixed in

4.0.4, 4.1.1

silverstripe/framework sends passwords back to browsers under some circumstances

Affected

>=3.5.5-rc1 <3.7.0 · >=4.0.3-rc1 <4.0.4 · >=4.1.0-rc1 <4.1.1

Fixed in

3.7.0, 4.0.4, 4.1.1

silverstripe/framework uploaded PHP script execution in assets

Affected

>=4.0.0-rc1 <4.0.4 · >=4.1.0-rc1 <4.1.1

Fixed in

4.0.4, 4.1.1

silverstripe/framework code execution vulnerability

Affected

>=4.0.3-rc1 <4.0.4 · >=4.1.0-rc1 <4.1.1

Fixed in

4.0.4, 4.1.1

silverstripe/framework BackURL validation bypass with malformed URLs

Affected

>=4.0.0-rc1 <4.0.4 · >=4.1.0-rc1 <4.1.1

Fixed in

4.0.4, 4.1.1

silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms

Affected

>=4.0.0-rc1 <4.0.1

Fixed in

4.0.1

silverstripe/framework Privilege Escalation Risk in Member Edit form

Affected

>=3.5.7-rc1 <3.5.8 · >=3.6.0-rc1 <3.6.6 · >=4.0.0-rc1 <4.0.4 · >=4.1.0-rc1 <4.1.1

Fixed in

3.5.8, 3.6.6, 4.0.4, 4.1.1

silverstripe/framework's URL parameters `isDev` and `isTest` unguarded

Affected

>=4.0.0-rc1 <4.0.4 · >=4.1.0rc1 <4.1.1

Fixed in

4.0.4, 4.1.1

silverstripe/framework SQL injection in full text search

Affected

>=3.5.0-rc1 <3.5.6 · >=3.6.0-rc1 <3.6.3 · >=4.0.0-rc1 <4.0.1

Fixed in

3.5.6, 3.6.3, 4.0.1

silverstripe/framework users inadvertently passing sensitive data to LoginAttempt

Affected

>=3.5.0-rc1 <3.5.6 · >=3.6.0-rc1 <3.6.3 · >=4.0.0-rc1 <4.0.1

Fixed in

3.5.6, 3.6.3, 4.0.1

silverstripe/framework CSV Excel Macro Injection

Affected

>=3.5.0-rc1 <3.5.6 · >=3.6.0-rc1 <3.6.3 · >=4.0.0-rc1 <4.0.1

Fixed in

3.5.6, 3.6.3, 4.0.1

silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms

Affected

>=3.5.0-rc1 <3.5.5 · >=3.6.0-rc1 <3.6.2

Fixed in

3.5.5, 3.6.2

silverstripe/framework's User-Agent header not correctly invalidating user session

Affected

>=3.5.0-rc1 <3.5.6 · >=3.6.0-rc1 <3.6.3

Fixed in

3.5.6, 3.6.3

silverstripe/framework has Cross-site Scripting vulnerability in page history comparison

Affected

>=3.4.0-rc1 <3.4.6 · >=3.5.0-rc1 <3.5.4

Fixed in

3.4.6, 3.5.4

silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage

Affected

>=3.4.0-rc1 <3.4.6 · >=3.5.0-rc1 <3.5.4

Fixed in

3.4.6, 3.5.4

silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL

Affected

>=3.1.0-rc1 <3.1.21 · >=3.2.0-rc1 <3.2.6 · >=3.3.0-rc1 <3.3.4 · >=3.4.0-rc1 <3.4.2

Fixed in

3.1.21, 3.2.6, 3.3.4, 3.4.2

silverstripe/framework has Cross-site Scripting vulnerability in page name

Affected

>=3.4.0-rc1 <3.4.4 · >=3.5.0-rc1 <3.5.2

Fixed in

3.4.4, 3.5.2

silverstripe/framework member disclosure in login form

Affected

>=3.4.0-rc1 <3.4.6 · >=3.5.0-rc1 <3.5.4

Fixed in

3.4.6, 3.5.4

silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField`

Affected

>=3.1.19-rc1 <3.1.20 · >=3.2.4-rc1 <3.2.5 · >=3.3.2-rc1 <3.3.3 · >=3.4.0-rc1 <3.4.1

Fixed in

3.1.20, 3.2.5, 3.3.3, 3.4.1

silverstripe/framework's `Member.Name` is not escaped

Affected

>=3.1.9-rc1 <3.1.20 · >=3.2.4-rc1 <3.2.5 · >=3.3.2-rc1 <3.3.3 · >=3.4.0-rc1 <3.4.1

Fixed in

3.1.20, 3.2.5, 3.3.3, 3.4.1

silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled

Affected

>=3.1.19-rc1 <3.1.20 · >=3.2.4-rc1 <3.2.5 · >=3.3.2-rc1 <3.3.3 · >=3.4.0-rc1 <3.4.1

Fixed in

3.1.20, 3.2.5, 3.3.3, 3.4.1

silverstripe/framework missing ACL on reports

Affected

>=3.1.19-rc1 <3.1.20 · >=3.2.4-rc1 <3.2.5 · >=3.3.2-rc1 <3.3.3 · >=3.4.0-rc1 <3.4.1

Fixed in

3.1.20, 3.2.5, 3.3.3, 3.4.1

silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()`

Affected

>=3.1.19-rc1 <3.1.20 · >=3.2.4-rc1 <3.2.5 · >=3.3.2-rc1 <3.3.3 · >=3.4.0-rc1 <3.4.1

Fixed in

3.1.20, 3.2.5, 3.3.3, 3.4.1

silverstripe/framework password encryption salt not updated

Affected

>=3.1.19-rc1 <3.1.20 · >=3.2.4-rc1 <3.2.5 · >=3.3.2-rc1 <3.3.3 · >=3.4.0-rc1 <3.4.1

Fixed in

3.1.20, 3.2.5, 3.3.3, 3.4.1

silverstripe/framework ReadOnly transformation for formfields exploitable

Affected

<3.1.21 · >=3.2.0 <3.2.6 · >=3.3.0 <3.3.4 · >=3.4.0 <3.4.2

Fixed in

3.1.21, 3.2.6, 3.3.4, 3.4.2

Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter

Affected

>=3.3.2 <3.3.3 · >=3.4.0 <3.4.1

Fixed in

3.3.3, 3.4.1

Silverstripe Missing CSRF protection in login form

Affected

>=3.1.18 <3.1.19 · >=3.2.3 <3.2.4 · >=3.3.1 <3.3.2

Fixed in

3.1.19, 3.2.4, 3.3.2

Silverstripe Brute force bypass on default admin

Affected

>=3.1.18 <3.1.19 · >=3.2.3 <3.2.4 · >=3.3.1 <3.3.2

Fixed in

3.1.19, 3.2.4, 3.3.2

Silverstripe XSS in CMS Edit Page

Affected

>=3.1.18 <3.1.19 · >=3.2.3 <3.2.4 · >=3.3.1 <3.3.2

Fixed in

3.1.19, 3.2.4, 3.3.2

Silverstripe Hostname, IP and Protocol Spoofing through HTTP Headers

Affected

<3.1.17 · >=3.2.0 <3.2.2 · >=3.3.0-beta1 <3.3.0

Fixed in

3.1.17, 3.2.2, 3.3.0

Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter

Affected

<3.1.17 · >=3.2.0 <3.2.2 · >=3.3.0-beta1 <3.3.0

Fixed in

3.1.17, 3.2.2, 3.3.0

Silverstripe Missing security check on dev/build/defaults

Affected

<3.1.17 · >=3.2.0 <3.2.2 · >=3.3.0-beta1 <3.3.0

Fixed in

3.1.17, 3.2.2, 3.3.0

Silverstripe HtmlEditor embed url sanitisation

Affected

>=3.0.0 <3.2.1

Fixed in

3.2.1

Silverstripe Form field validation message XSS vulnerability

Affected

>=3.0.0 <3.1.16 · >=3.2.0 <3.2.1

Fixed in

3.1.16, 3.2.1

Silverstripe framework is vulnerable to XSS in install.php

Affected

>=3.1.0 <3.1.14

Fixed in

3.1.14

SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation

Affected

>=3.0.0 <3.0.14 · >=3.1.0 <3.1.13

Fixed in

3.0.14, 3.1.13

Silverstripe XSS in dev/build returnURL Parameter

Affected

<3.1.14

Fixed in

3.1.14

Silverstripe External redirection risk in Security?ReturnURL

Affected

<3.0.14 · >=3.1.0 <3.1.13

Fixed in

3.0.14, 3.1.13

Silverstripe X-Forwarded-Host request hostname injection

Affected

>=3.1.0 <3.1.13

Fixed in

3.1.13

Silverstripe XSS in Director::force_redirect()

Affected

>=3.1.0 <3.1.12

Fixed in

3.1.12

Silverstripe XSS In FormAction

Affected

>=3.1.0 <3.1.10

Fixed in

3.1.10

Silverstripe XSS In rewritten hash links

Affected

<3.0.13 · >=3.1.0 <3.1.12

Fixed in

3.0.13, 3.1.12

Silverstripe XSS In GridField print

Affected

>=3.1.0 <3.1.10

Fixed in

3.1.10

Silverstripe XSS in TreeDropdownField and TreeMultiSelectField

Affected

>=3.1.0 <3.1.10

Fixed in

3.1.10

SilverStripe framework XML Quadratic Blowup Attack

Affected

<3.1.12

Fixed in

3.1.12

Silverstripe IE requests not properly behaving with rewritehashlinks

Affected

<3.0.13 · >=3.1.0 <3.1.12

Fixed in

3.0.13, 3.1.12

Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter

Affected

<4.13.39 · >=5.0.0 <5.1.11

Fixed in

4.13.39, 5.1.11

Silverstripe Framework: Members with no password can be created and bypass custom login forms

Affected

>=3.0.0 <4.13.14 · >=5.0.0 <5.0.13

Fixed in

4.13.14, 5.0.13

Missing permission check of canView in GridFieldPrintButton

Affected

<4.12.5

Fixed in

4.12.5

Open redirect vulnerability on CMSSecurity relogin screen

Affected

<4.12.5

Fixed in

4.12.5

Blind SQL Injection via GridFieldSortableHeader

Affected

>=4.0.0 <4.10.11 · >=4.11.0 <4.11.14

Fixed in

4.10.11, 4.11.14

Reflected XSS in querystring parameters

Affected

>=4.0.0 <4.11.13

Fixed in

4.11.13

Stored XSS using HTMLEditor

Affected

>=4.0.0 <4.11.13

Fixed in

4.11.13

Stored XSS using uppercase characters in HTMLEditor

Affected

>=4.0.0 <4.11.13

Fixed in

4.11.13

Silverstripe XSS in shortcodes

Affected

>=4.0.0 <4.11.13

Fixed in

4.11.13

Quadratic blowup in Convert::xml2array()

Affected

>=4.0.0 <4.10.9

Fixed in

4.10.9

Stored XSS via HTML fields in SilverStripe Framework

Affected

>=4.0.0 <4.10.9

Fixed in

4.10.9

Stored XSS in link tags added via XHR in SilverStripe Framework

Affected

>=4.0.0 <4.10.9

Fixed in

4.10.9

SilverStripe XXE Vulnerability in CSSContentParser

Affected

>=4.0.0 <4.7.4

Fixed in

4.7.4

Silverstripe CMS XSS Vulnerability

Affected

>=3.0.0 <3.7.5

Fixed in

3.7.5

Silverstripe CMS information disclosure

Affected

>=4.0.0 <4.4.7 · >=4.5.0 <4.5.4

Fixed in

4.4.7, 4.5.4

SilverStripe Web Cache Poisoning through HTTPRequestBuilder

Affected

>=4.0.0 <4.4.7 · >=4.5.0 <4.5.4 · >=3.0.0 <3.7.5

Fixed in

3.7.5, 4.4.7, 4.5.4

SilverStripe Folders migrated from 3.x may be unsafe to upload to

Affected

>=4.0.0 <4.4.6

Fixed in

4.4.6

SilverStripe Denial of Service on flush and development URL tools

Affected

>=4.0.0 <4.4.0 · <=3.6

Fixed in

4.4.0

SilverStripe asset-admin Cross-site Scripting (XSS)

Affected

>=4.0.0 <4.3.5 · >=4.4.0 <4.4.4

Fixed in

4.3.5, 4.4.4

Silverstripe Flash Clipboard Reflected XSS

Affected

>=3.0.0 <4.3.5 · >=4.4.0-rc1 <4.4.4

Fixed in

4.3.5, 4.4.4

Silverstripe XSS Vulnerabilities

Affected

>=2.3 <2.3.13 · >=2.4 <2.4.7

Fixed in

2.3.13, 2.4.7

SilverStripe CSV Excel Macro Injection

Affected

<3.5.6 · >=3.6.0 <3.6.3 · >=4.0.0 <4.0.1

Fixed in

3.5.6, 3.6.3, 4.0.1

Silverstripe CMS Open Redirect

Affected

<=3.1.13

Fixed in

No fix released

SilverStripe vulnerable to Cross-site Scripting

Affected

<2.3.5

Fixed in

2.3.5

Silverstripe Framework SQLi Vulnerability

Affected

>=3.0.0 <3.6.7 · >=4.0.0 <4.0.7 · >=3.7.0 <3.7.3 · >=4.1.0 <4.1.5 · >=4.2.0 <4.2.4 · >=4.3.0 <4.3.1

Fixed in

3.6.7, 3.7.3, 4.0.7, 4.1.5, 4.2.4, 4.3.1

FormField with square brackets in field name skips validation

Affected

>=3.0.0 <4.7.4

Fixed in

4.7.4

Business Logic Errors in SilverStripe Framework

Affected

<4.10.1

Fixed in

4.10.1

Broken access control on files

Affected

>=4.0.0 <4.3.5 · >=4.4.0 <4.4.4

Fixed in

4.3.5, 4.4.4

Reflected XSS in SilverStripe

Affected

>=4.5.0 <4.5.2 · >=4.0.0 <4.4.5

Fixed in

4.4.5, 4.5.2

SilverStripe Priviledge escalation through cache pollution

Affected

>=4.4.0 <4.4.4 · >=4.3.0 <4.3.5

Fixed in

4.3.5, 4.4.4

Lack of access control on upoaded files

Affected

<3.6.8 · >=3.7.0 <3.7.4 · >=4.0.0 <4.3.6 · >=4.4.0 <4.4.4

Fixed in

3.6.8, 3.7.4, 4.3.6, 4.4.4

Session fixation in change password form

Affected

>=3.7.0 <3.7.4 · >=4.4.0 <4.4.4 · >=3.6.0 <3.6.8 · >=4.0.0 <4.3.5

Fixed in

3.6.8, 3.7.4, 4.3.5, 4.4.4

Missing warning can lead to unauthenticated admin access in SilverStripe

Affected

>=4.1.0 <4.3.5

Fixed in

4.3.5

SilverStripe Versioned Files module Unpublished files are exposed publicly

Affected

>=4.0.0 <4.3.5 · >=4.4.0 <4.4.4

Fixed in

4.3.5, 4.4.4