CVE-2022-25238 Stored XSS via HTML fields in SilverStripe Framework

Medium 5.4 Published 28 Jun 2022 Updated 3 Aug 2024

Authenticated CMS users can inject XSS via script tags in content if specific sanitization settings are not enabled in the Silverstripe framework.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-25238?

CVE-2022-25238 is a medium-severity cross-site scripting vulnerability in n/a, published on 28 Jun 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.

Weakness: CWE-79

Which versions are affected by CVE-2022-25238?

2 open source packages ship an affected version, including silverstripe/framework. It affects 1 product.

Package	Affected	Fixed in
`silverstripe/framework` Packagist	From `4.0.0`	`4.10.9`
`silverstripe/framework` Packagist	From `4.0.0`	`4.10.9`

Products include Silverstripe Framework.

How do I fix CVE-2022-25238?

Upgrade silverstripe/framework to 4.10.9 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-25238 being exploited?

There is no known exploitation of CVE-2022-25238 in the wild and no public exploit code.

Sources

Also known as GHSA-jx34-gqqq-r6gm.