GHSA-88jp-9jrv-6368: Silverstripe XSS In GridField print
A cross-site scripting vulnerability has been discovered in the print view of GridField.
This vulnerability can only be exploited if a user with CMS access has posted malicious or unescaped HTML into any field of an object in a GridField, and the print feature is used.
This has been resolved by ensuring that the print feature safely escapes all fields.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-006-1.yaml
- github.com/advisories/GHSA-88jp-9jrv-6368
- github.com/silverstripe/silverstripe-framework
- github.com/silverstripe/silverstripe-framework/commit/cebc0d08c5cc8177c2462a963b76e5bc7827146d
- www.silverstripe.org/software/download/security-releases/ss-2015-006
Code Behaviors & Features
Detect and mitigate GHSA-88jp-9jrv-6368 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →