GHSA-r32j-mr8p-hfp8: Silverstripe XSS in TreeDropdownField and TreeMultiSelectField
A cross-site scripting vulnerability has been discovered in the TreeDropdownField and TreeMultiSelectField.
This vulnerability can only be exploited if a user with CMS access has posted malicious or unescaped HTML into any of the dataobjects used as a data source for either of these fields.
This has been resolved by ensuring that all dataobjects used as a data source have their content safely encoded.
References
- github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-004-1.yaml
- github.com/advisories/GHSA-r32j-mr8p-hfp8
- github.com/silverstripe/silverstripe-framework
- github.com/silverstripe/silverstripe-framework/commit/89c14d079d3a130d6c4029af596262528ce53925
- www.silverstripe.org/software/download/security-releases/ss-2015-004
Code Behaviors & Features
Detect and mitigate GHSA-r32j-mr8p-hfp8 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →