MediumGHSA-mqf5-275h-gf6r
Silverstripe framework is vulnerable to XSS in install.php
Published 23 May 2024 · Updated 28 Nov 2024
Affected package
silverstripe/frameworkComposer
- Affected
- >=3.1.0 <3.1.14
- Fixed in
- 3.1.14
Update to the fixed version for your release line, for example:
composer require silverstripe/framework:^3.1.14Details
During installation, certain parameters (admin_username and admin_password) are not escaped in the setup form.
This issue is resolved in 3.1.14 stable, although existing users are advised to remove this file prior to deploying to a production server.
Is GHSA-mqf5-275h-gf6r in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected silverstripe/framework, and gives you the command that fixes it.
References
- Linkgithub.com/silverstripe/silverstripe-framework/commit/4c73721bab0d543eee6137e3c00aa8ec727e95d1
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-016-1.yaml
- Packagegithub.com/silverstripe/silverstripe-framework
- Linkwww.silverstripe.org/software/download/security-releases/ss-2015-016
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.