CVE-2022-38724: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

November 23, 2022 (updated November 28, 2022)

Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS.

References

forum.silverstripe.org/c/releases
nvd.nist.gov/vuln/detail/CVE-2022-38724
www.silverstripe.org/blog/tag/release
www.silverstripe.org/download/security-releases/
www.silverstripe.org/download/security-releases/CVE-2022-38724

Code Behaviors & Features

Detect and mitigate CVE-2022-38724 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →