GHSA-qw4w-vq8v-2wcv

Source

https://github.com/advisories/GHSA-qw4w-vq8v-2wcv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-qw4w-vq8v-2wcv/GHSA-qw4w-vq8v-2wcv.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-qw4w-vq8v-2wcv

Aliases

CVE-2022-37430

Published

2022-11-21T23:59:38Z

Modified

2024-02-20T05:19:44.380034Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Stored XSS using uppercase characters in HTMLEditor

Details

A malicious content author could add a Javascript payload to the href attribute of a link. A similar issue was identified and fixed via CVE-2022-28803. However, the fix didn't account for the casing of the href attribute. An attacker must have access to the CMS to exploit this issue.

Database specific

{
    "nvd_published_at": "2022-11-23T02:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-21T23:59:38Z"
}

References

Affected packages

Packagist / silverstripe/framework

Package

Name: silverstripe/framework
Purl: pkg:composer/silverstripe/framework

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.11.13

Affected versions

4.*

4.0.0

4.0.1-rc1

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.1.0-rc1

4.1.0-rc2

4.1.0

4.1.1

4.1.2

4.1.3

4.1.4

4.1.5

4.2.0-beta1

4.2.0

4.2.1

4.2.2

4.2.3

4.2.4

4.2.5

4.3.0-rc1

4.3.0

4.3.1

4.3.2

4.3.3

4.3.4

4.3.5

4.4.0-rc1

4.4.0

4.4.1

4.4.2

4.4.3

4.4.4

4.4.5

4.4.6

4.4.7

4.5.0-alpha1

4.5.0-rc1

4.5.0-rc2

4.5.0

4.5.1

4.5.2

4.5.3

4.5.4

4.6.0-beta1

4.6.0-rc1

4.6.0

4.6.1

4.6.2

4.7.0-beta1

4.7.0-rc1

4.7.0

4.7.1

4.7.2

4.7.3

4.7.4

4.8.0-beta1

4.8.0-rc1

4.8.0

4.8.1

4.9.0-alpha1

4.9.0-beta1

4.9.0-rc1

4.9.0

4.9.1

4.9.2

4.9.3

4.9.4

4.10.0-beta1

4.10.0-rc1

4.10.0

4.10.1

4.10.2

4.10.3

4.10.4

4.10.5

4.10.6

4.10.7

4.10.8

4.10.9

4.10.10

4.10.11

4.11.0-beta1

4.11.0-beta2

4.11.0-beta3

4.11.0-rc1

4.11.0

4.11.1

4.11.2

4.11.3

4.11.4

4.11.5

4.11.6

4.11.7

4.11.8

4.11.9

4.11.10

4.11.11

4.11.12