CVE-2022-38145 Stored XSS in Compare Mode

What is CVE-2022-38145?

CVE-2022-38145 is a medium-severity cross-site scripting vulnerability in n/a, published on 23 Nov 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view.

Weakness: CWE-79

Which versions are affected by CVE-2022-38145?

2 open source packages ship an affected version, including silverstripe/versioned-admin. It affects 1 product.

Products include Silverstripe Framework.

How do I fix CVE-2022-38145?

Upgrade silverstripe/versioned-admin to 1.11.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-38145 being exploited?

There is no known exploitation of CVE-2022-38145 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-38148 Blind SQL Injection via GridFieldSortableHeader High 8.8
• CVE-2022-38462 Reflected XSS in querystring parameters Medium 6.1
• CVE-2025-30148 Silverstripe Framework has a XSS vulnerability in HTML editor Medium 5.4
• CVE-2024-53277 Cross-site Scripting in form messages in silverstripe framework Medium 5.4
• CVE-2024-32981 Cross-site Scripting vulnerability with encoded payload in silverstripe/framework Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-66jf-xm2m-7m8r.