{"answers":{"affected":"2 open source packages ship an affected version, including dnadesign/silverstripe-elemental.","exploited":"There is no known exploitation of CVE-2025-25197 in the wild and no public exploit code.","fix":"Upgrade dnadesign/silverstripe-elemental to 5.3.12 or later.","what":"CVE-2025-25197 is a medium-severity cross-site scripting vulnerability in silverstripe-elemental, published on 10 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-25197 and fix it if it is affected.\n\nWhat it is: CVE-2025-25197 is a medium-severity cross-site scripting vulnerability in silverstripe-elemental, published on 10 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-25197 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- dnadesign/silverstripe-elemental (Packagist): affected from 2.1.2; fixed in 5.3.12\n- dnadesign/silverstripe-elemental (Packagist): affected from 2.1.2; fixed in 5.3.12\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-25197/ (Markdown: https://insights.sbomify.com/CVE-2025-25197/index.md)","id":"CVE-2025-25197","markdown":"https://insights.sbomify.com/CVE-2025-25197/index.md","name":"CVE-2025-25197","record":{"aliases":["GHSA-x8xm-c7p8-2pj2"],"analysis":{"component_type":"cms_plugin","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Silverstripe Elemental module","requires_auth":"low_privilege","summary":"Attackers can inject malicious scripts into Silverstripe Elemental content blocks, leading to XSS execution when viewing specific reports.","user_interaction":"not_required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":5.4,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the \"Content blocks in use\" report. The vulnerability is specific to that report and is a result of failure to cast input prior to including it in the grid field. This vulnerability is fixed in 5.3.12.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Silverstripe Elemental enables XSS attacks in elemental \"Content blocks in use\" reports","id":"CVE-2025-25197","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"xss","year":"2025"},"n_packages":2,"n_references":3,"next":{"headline":"mailcow: dockerized vulnerable to password reset poisoning","id":"CVE-2025-25198"},"packages":[{"ecosystem":"Packagist","fixed":["5.3.12"],"introduced":["2.1.2"],"last_affected":[],"package":"dnadesign/silverstripe-elemental","purl":null,"source":"GHSA-x8xm-c7p8-2pj2"},{"ecosystem":"Packagist","fixed":["5.3.12"],"introduced":["2.1.2"],"last_affected":[],"package":"dnadesign/silverstripe-elemental","purl":"pkg:composer/dnadesign/silverstripe-elemental","source":"GHSA-x8xm-c7p8-2pj2"}],"prev":{"headline":"OpenFGA Authorization Bypass","id":"CVE-2025-25196"},"products":["silverstripe-elemental"],"published":"2025-04-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-04-10","vendors":["silverstripe"]},"summary":"Attackers can inject malicious scripts into Silverstripe Elemental content blocks, leading to XSS execution when viewing specific reports.","url":"https://insights.sbomify.com/CVE-2025-25197/"}