GHSA-6hh6-59j2-qrxw: Silverstripe History XSS Vulnerability

May 22, 2024

A cross-site scripting vulnerability has been discovered in the CMS page history tab.

This vulnerability can only be exploited if a user with CMS access has posted malicious or unescaped HTML into any of the text fields on a page, and if the “compare mode” option is selected. The HTML will be embedded into the page unescaped.

This has been resolved by performing the text comparison in a HTML friendly way.

References

github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/cms/SS-2015-003-1.yaml
github.com/advisories/GHSA-6hh6-59j2-qrxw
github.com/silverstripe/silverstripe-cms
www.silverstripe.org/software/download/security-releases/ss-2015-003

Code Behaviors & Features

Detect and mitigate GHSA-6hh6-59j2-qrxw with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →