GHSA-hq4p-5mpr-jj9m: Silverstripe XSS in dev/build returnURL Parameter
A XSS risk exists in the returnURL parameter passed to dev/build. An unvalidated url could cause the user to redirect to an unverified third party url outside of the site.
This issue is resolved in framework 3.1.14 stable release.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-015-1.yaml
- github.com/advisories/GHSA-hq4p-5mpr-jj9m
- github.com/silverstripe/silverstripe-framework
- github.com/silverstripe/silverstripe-framework/commit/751d77386c3c6e354b521fa61ff142f95895cca8
- www.silverstripe.org/software/download/security-releases/ss-2015-015
Code Behaviors & Features
Detect and mitigate GHSA-hq4p-5mpr-jj9m with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →