CVE-2020-9311

MEDIUM5.4EPSS 0.34%

Silverstripe CMS XSS Vulnerability

Published: 5/24/2022Modified: 2/17/2024

Also known as:GHSA-2pw2-qpcp-m47xBIT-silverstripe-2020-9311

Description

In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted login form URLs.

Affected packages (3)

Bitnami/silverstripe>= 3.0.0, < 3.7.5
Packagist/silverstripe/cmsfrom 0, <= 4.5.0
Packagist/silverstripe/framework>= 3.0.0, < 3.7.5

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-9311
PATCHhttps://github.com/silverstripe/silverstripe-cms
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2020-9311.yaml
WEBhttps://www.silverstripe.org/download/security-releases/cve-2020-9311
WEBhttps://www.silverstripe.org/download/security-releases/CVE-2020-9311