CVE-2023-22729: URL Redirection to Untrusted Site ('Open Redirect')

April 26, 2023

Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, an attacker can display a link to a third party website on a login screen by convincing a legitimate content author to follow a specially crafted link. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.

References

github.com/advisories/GHSA-fw84-xgm8-9jmv
github.com/silverstripe/silverstripe-framework/commit/1a5bb4cbece1721203977910b8ecd8b79c18dc77
github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-fw84-xgm8-9jmv
nvd.nist.gov/vuln/detail/CVE-2023-22729

Code Behaviors & Features

Detect and mitigate CVE-2023-22729 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →