CVE-2020-9311

MEDIUM5.4EPSS 0.34%

Silverstripe CMS XSS Vulnerability

發布日:2022/5/24修改日:2024/2/17

也稱為:GHSA-2pw2-qpcp-m47xBIT-silverstripe-2020-9311

描述

In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted login form URLs.

受影響套件(3)

Bitnami/silverstripe>= 3.0.0, < 3.7.5
Packagist/silverstripe/cmsfrom 0, <= 4.5.0
Packagist/silverstripe/framework>= 3.0.0, < 3.7.5

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-9311
PATCHhttps://github.com/silverstripe/silverstripe-cms
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2020-9311.yaml
WEBhttps://www.silverstripe.org/download/security-releases/cve-2020-9311
WEBhttps://www.silverstripe.org/download/security-releases/CVE-2020-9311