CVE-2019-12205

MEDIUM6.1EPSS 0.38%

Silverstripe Flash Clipboard Reflected XSS

Published: 5/24/2022Modified: 2/17/2024

Description

SilverStripe versions 3.0.0 until 4.3.5 and 4.4.4 are vulnerable to Flash Clipboard Reflected XSS. Versions 4.3.5 and 4.4.4 of `silverstripe/framework` and version 1.3.5 of `silverstripe/admin` contain a fix for this issue.

Affected packages (2)

Packagist/silverstripe/adminfrom 0, < 1.3.5
Packagist/silverstripe/framework>= 3.0.0, < 4.3.5

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-12205
WEBhttps://forum.silverstripe.org/c/releases
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2019-12205.yaml
WEBhttps://github.com/silverstripe/silverstripe-admin/commit/6e6fa5c618b9dbf4cc0a56704834bfa1d5b0d18e
WEBhttps://www.silverstripe.org/download/security-releases
WEBhttps://www.silverstripe.org/download/security-releases/cve-2019-12205
WEBhttps://www.silverstripe.org/download/security-releases/CVE-2019-12205