SilverStripe vulnerable to Cross-site Scripting
Published 14 May 2022 · Updated 11 Apr 2025
Affected packages
- Affected
- <2.3.5
- Fixed in
- 2.3.5
composer require silverstripe/cms:^2.3.5- Affected
- <2.3.5
- Fixed in
- 2.3.5
composer require silverstripe/framework:^2.3.5Details
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).
Is GHSA-wg4m-vvp6-2hc5 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected silverstripe/cms, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2010-1593
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/55838
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/55839
- Linkweb.archive.org/web/20200228222759/https://www.securityfocus.com/bid/37923
- Linkweb.archive.org/web/20201208002434/http://www.securityfocus.com/archive/1/509139/100/0/threaded
- Linkarchives.neohapsis.com/archives/fulldisclosure/2010-01/0450.html
- Linkgroups.google.com/group/silverstripe-announce/browse_thread/thread/f51749342eee9456
- Linkopen.silverstripe.org/changeset/97074
- Linkopen.silverstripe.org/wiki/ChangeLog/2.3.5
- Linkwww.silverstripe.org/security-releases
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.