CVE-2023-28851

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-28851
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-28851.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-28851
Aliases
Published
2023-04-03T17:36:22Z
Modified
2025-10-30T20:19:58.357755Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Silverstripe Form Capture vulnerable to Stored Cross-Site Scripting
Details

Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to perform a Cross-Site Scripting attack. The vulnerability was initially patched in version 1.0.2, and version 1.1.0 includes this patch. The bug was then accidentally re-introduced during a merge error, and has been re-patched in versions 2.2.5 and 3.1.1. There are no known workarounds for this vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-79",
        "CWE-80"
    ]
}
References

Affected packages

Git / github.com/bigfork/silverstripe-form-capture

Affected ranges

Type
GIT
Repo
https://github.com/bigfork/silverstripe-form-capture
Events
Introduced
03a99560d26cb83faf0582de52dad348c3da6026
Fixed
97f974726cf39137c67910befa002cb6e9c8d7a9
Database specific 
{
    "versions": [
        {
            "introduced": "0.2.0"
        },
        {
            "fixed": "1.0.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/bigfork/silverstripe-form-capture
Events
Introduced
9b6b9f4039f935d73f8b7f99a519f9d90ba6bd6a
Fixed
af71d2711c956d13d6f4efbfdbf6e1e047360f77
Database specific 
{
    "versions": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.2.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/bigfork/silverstripe-form-capture
Events
Introduced
c6c9e0662f9e4812a304d2251e39e351d232be5c
Fixed
5b3aa39dd1eef042f173167b0fa4d3f717971772
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.1.1"
        }
    ]
}

Affected versions

0.*

0.2.0
0.2.1
0.2.3

1.*

1.0
1.0.1

2.*

2.0.0
2.0.1
2.0.2
2.1.0
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4

3.*

3.0.0
3.1.0