{"id":"GHSA-xgpf-p52j-pf7m","aliases":["CVE-2021-27938"],"title":"XSS in CreateQueuedJobTask","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL.","severity":"medium","score":null,"published":"2021-03-24T17:42:02.000Z","modified":"2024-12-02T05:49:22.917Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"symbiote/silverstripe-queuedjobs","sources":[{"name":"OSV · GHSA-xgpf-p52j-pf7m","url":"https://osv.dev/vulnerability/GHSA-xgpf-p52j-pf7m"}],"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.0.2"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1"],"fixed":["3.0.2"]},{"ecosystem":"Packagist","name":"symbiote/silverstripe-queuedjobs","sources":[{"name":"OSV · GHSA-xgpf-p52j-pf7m","url":"https://osv.dev/vulnerability/GHSA-xgpf-p52j-pf7m"}],"ranges":[{"events":[{"introduced":"3.1.0"},{"fixed":"3.1.4"}],"type":"ECOSYSTEM"}],"versions":["3.1.0","3.1.1","3.1.2","3.1.3"],"fixed":["3.1.4"]},{"ecosystem":"Packagist","name":"symbiote/silverstripe-queuedjobs","sources":[{"name":"OSV · GHSA-xgpf-p52j-pf7m","url":"https://osv.dev/vulnerability/GHSA-xgpf-p52j-pf7m"}],"ranges":[{"events":[{"introduced":"4.0.0"},{"fixed":"4.0.7"}],"type":"ECOSYSTEM"}],"versions":["4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6"],"fixed":["4.0.7"]},{"ecosystem":"Packagist","name":"symbiote/silverstripe-queuedjobs","sources":[{"name":"OSV · GHSA-xgpf-p52j-pf7m","url":"https://osv.dev/vulnerability/GHSA-xgpf-p52j-pf7m"}],"ranges":[{"events":[{"introduced":"4.1.0"},{"fixed":"4.1.2"}],"type":"ECOSYSTEM"}],"versions":["4.1.0","4.1.1"],"fixed":["4.1.2"]},{"ecosystem":"Packagist","name":"symbiote/silverstripe-queuedjobs","sources":[{"name":"OSV · GHSA-xgpf-p52j-pf7m","url":"https://osv.dev/vulnerability/GHSA-xgpf-p52j-pf7m"}],"ranges":[{"events":[{"introduced":"4.2.0"},{"fixed":"4.2.4"}],"type":"ECOSYSTEM"}],"versions":["4.2.0","4.2.1","4.2.2","4.2.3"],"fixed":["4.2.4"]},{"ecosystem":"Packagist","name":"symbiote/silverstripe-queuedjobs","sources":[{"name":"OSV · GHSA-xgpf-p52j-pf7m","url":"https://osv.dev/vulnerability/GHSA-xgpf-p52j-pf7m"}],"ranges":[{"events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}],"type":"ECOSYSTEM"}],"versions":["4.3.0","4.3.1","4.3.2"],"fixed":["4.3.3"]},{"ecosystem":"Packagist","name":"symbiote/silverstripe-queuedjobs","sources":[{"name":"OSV · GHSA-xgpf-p52j-pf7m","url":"https://osv.dev/vulnerability/GHSA-xgpf-p52j-pf7m"}],"ranges":[{"events":[{"introduced":"4.4.0"},{"fixed":"4.4.3"}],"type":"ECOSYSTEM"}],"versions":["4.4.0","4.4.1","4.4.2"],"fixed":["4.4.3"]},{"ecosystem":"Packagist","name":"symbiote/silverstripe-queuedjobs","sources":[{"name":"OSV · GHSA-xgpf-p52j-pf7m","url":"https://osv.dev/vulnerability/GHSA-xgpf-p52j-pf7m"}],"ranges":[{"events":[{"introduced":"4.5.0"},{"fixed":"4.5.1"}],"type":"ECOSYSTEM"}],"versions":["4.5.0"],"fixed":["4.5.1"]},{"ecosystem":"Packagist","name":"symbiote/silverstripe-queuedjobs","sources":[{"name":"OSV · GHSA-xgpf-p52j-pf7m","url":"https://osv.dev/vulnerability/GHSA-xgpf-p52j-pf7m"}],"ranges":[{"events":[{"introduced":"4.6.0"},{"fixed":"4.6.4"}],"type":"ECOSYSTEM"}],"versions":["4.6.0","4.6.1","4.6.2","4.6.3"],"fixed":["4.6.4"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-27938","https://github.com/FriendsOfPHP/security-advisories/blob/master/symbiote/silverstripe-queuedjobs/CVE-2021-27938.yaml","https://github.com/symbiote/silverstripe-queuedjobs/releases","https://www.silverstripe.org/download/security-releases/cve-2021-27938"],"sources":[{"name":"OSV","id":"GHSA-xgpf-p52j-pf7m","modified":"2024-12-02T05:49:22.917580Z","url":"https://osv.dev/vulnerability/GHSA-xgpf-p52j-pf7m"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T21:15:31.530Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}