GHSA-mpqj-f4v3-334h — Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter

The advisory, in context

A cross-site scripting vulnerability in VersionedRequestFilter has been found.

If an incoming user request should not be able to access the requested stage, an error message is created for display on the CMS login page that they are redirected to. In this error message, the URL of the requested page is interpolated into the error message without being escaped; hence, arbitrary HTML can be injected into the CMS login page.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

silverstripe/framework Packagist

Ecosystem versions

From 3.3.2 before 3.3.3

Fixed in 3.3.3

3 explicitly affected versions

3.3.2, 3.3.3-rc1, 3.3.3-rc2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.3.2"
        },
        {
          "fixed": "3.3.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.3.2",
    "3.3.3-rc1",
    "3.3.3-rc2"
  ]
}

silverstripe/framework Packagist

Ecosystem versions

From 3.4.0 before 3.4.1

Fixed in 3.4.1

3 explicitly affected versions

3.4.0, 3.4.1-rc1, 3.4.1-rc2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "3.4.0"
        },
        {
          "fixed": "3.4.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.4.0",
    "3.4.1-rc1",
    "3.4.1-rc2"
  ]
}

Set up in your agent.

Investigate in your agent.

Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter

The advisory, in context

Affected packages

References