{"id":"GHSA-v358-rvxr-wffx","aliases":["CVE-2012-4968"],"title":"Silverstripe XSS Vulnerabilities","description":"Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via \n1. a crafted string to the `AbsoluteLinks`\n1. `BigSummary`\n1. `ContextSummary`\n1. `EscapeXML`\n1. `FirstParagraph`\n1. `FirstSentence`\n1. `Initial`\n1. `LimitCharacters`\n1. `LimitSentences`\n1. `LimitWordCount`\n1. `LimitWordCountXML`\n1. `Lower`\n1. `LowerCase`\n1. `NoHTML`\n1. `Summary`\n1. `Upper`\n1. `UpperCase`, or \n1. `URL` method in a template, \n\ndifferent vectors than CVE-2012-0976.","severity":"medium","score":null,"published":"2022-05-17T05:22:19.000Z","modified":"2024-01-12T20:41:37.101Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"silverstripe/framework","ranges":[{"events":[{"introduced":"2.3"},{"fixed":"2.3.13"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["2.3.13"]},{"ecosystem":"Packagist","name":"silverstripe/framework","ranges":[{"events":[{"introduced":"2.4"},{"fixed":"2.4.7"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["2.4.7"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2012-4968","https://github.com/silverstripe/sapphire/commit/0085876","https://github.com/silverstripe/silverstripe-framework/commit/0085876495f0f8dda5dc58cb24a8f2220e7baf1e","https://github.com/silverstripe/silverstripe-framework/commit/15e9e059e5948ccf8f5a36dfcb435ad26ecec334","https://github.com/silverstripe/silverstripe-framework","http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13","http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7","http://www.openwall.com/lists/oss-security/2012/04/30/1","http://www.openwall.com/lists/oss-security/2012/04/30/3"],"sources":[{"name":"OSV","id":"GHSA-v358-rvxr-wffx","modified":"2024-01-12T20:41:37.101821Z","url":"https://osv.dev/vulnerability/GHSA-v358-rvxr-wffx"}],"assessments":[]}