GHSA-pp7q-6j3f-74vjmedium6.1
silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage
No CVE assignedCheck your stack
The advisory, in context
RedirectorPage will allow users to specify a non-url malicious script as the redirection path without validation. Users which follow this url may allow this script to execute within their browser.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
silverstripe/framework Packagist
Ecosystem versions
From 3.4.0-rc1 before 3.4.6
Fixed in 3.4.6
14 explicitly affected versions
3.4.0, 3.4.0-rc1, 3.4.1, 3.4.1-rc1, 3.4.1-rc2, 3.4.2, 3.4.3, 3.4.3-rc1, 3.4.4, 3.4.4-rc1, 3.4.5, 3.4.5-rc1, 3.4.6-rc1, 3.4.6-rc2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.4.0-rc1"
},
{
"fixed": "3.4.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.4.0",
"3.4.0-rc1",
"3.4.1",
"3.4.1-rc1",
"3.4.1-rc2",
"3.4.2",
"3.4.3",
"3.4.3-rc1",
"3.4.4",
"3.4.4-rc1",
"3.4.5",
"3.4.5-rc1",
"3.4.6-rc1",
"3.4.6-rc2"
]
}silverstripe/framework Packagist
Ecosystem versions
From 3.5.0-rc1 before 3.5.4
Fixed in 3.5.4
12 explicitly affected versions
3.5.0, 3.5.0-rc1, 3.5.0-rc2, 3.5.0-rc3, 3.5.1, 3.5.1-rc1, 3.5.1-rc2, 3.5.2, 3.5.2-rc1, 3.5.3, 3.5.3-rc1, 3.5.4-rc1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.5.0-rc1"
},
{
"fixed": "3.5.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.0",
"3.5.0-rc1",
"3.5.0-rc2",
"3.5.0-rc3",
"3.5.1",
"3.5.1-rc1",
"3.5.1-rc2",
"3.5.2",
"3.5.2-rc1",
"3.5.3",
"3.5.3-rc1",
"3.5.4-rc1"
]
}