GMS-2022-6859: Stored XSS using HTMLEditor

November 21, 2022

A malicious content author could add a JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters.

An attacker must have access to the CMS to exploit this issue.

References

github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-37429.yaml
github.com/advisories/GHSA-wc6r-4ggc-79w5
www.silverstripe.org/download/security-releases/cve-2022-37429

Code Behaviors & Features

Detect and mitigate GMS-2022-6859 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →