GHSA-mqf5-275h-gf6r: Silverstripe framework is vulnerable to XSS in install.php
During installation, certain parameters (admin_username and admin_password) are not escaped in the setup form.
This issue is resolved in 3.1.14 stable, although existing users are advised to remove this file prior to deploying to a production server.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-016-1.yaml
- github.com/advisories/GHSA-mqf5-275h-gf6r
- github.com/silverstripe/silverstripe-framework
- github.com/silverstripe/silverstripe-framework/commit/4c73721bab0d543eee6137e3c00aa8ec727e95d1
- www.silverstripe.org/software/download/security-releases/ss-2015-016
Code Behaviors & Features
Detect and mitigate GHSA-mqf5-275h-gf6r with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →