GMS-2022-6860: Stored XSS in Compare Mode

November 22, 2022

A malicious content author could add a Javascript payload to a page’s meta description and get it executed in the versioned history compare view.

This vulnerability requires access to the CMS to be deployed. The attacker must then convince a privileged user to access the version history for that page.

References

github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/versioned-admin/CVE-2022-38145.yaml
github.com/advisories/GHSA-66jf-xm2m-7m8r
www.silverstripe.org/download/security-releases/cve-2022-38145

Code Behaviors & Features

Detect and mitigate GMS-2022-6860 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →