GHSA-4q66-g4mm-8rg5 Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE
Attackers can execute arbitrary scripts in Silverstripe CMS 4 admin interfaces via vulnerable TinyMCE components, potentially compromising user accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-4q66-g4mm-8rg5?
GHSA-4q66-g4mm-8rg5 is a cross-site scripting vulnerability in silverstripe/admin, published on 31 Jul 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin.
Only Silverstripe CMS 4 is affected by this issue. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin.
Silverstripe CMS 5 is not affected by those vulnerabilities because it uses TinyMCE 6.
You can find more information about the underlying vulnerabilities in those GitHub security advisories:
Which versions are affected by GHSA-4q66-g4mm-8rg5?
2 open source packages ship an affected version, including silverstripe/admin.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/admin Packagist | All versions | 1.13.6 |
silverstripe/admin Packagist | All versions | 1.13.6 |
How do I fix GHSA-4q66-g4mm-8rg5?
Upgrade silverstripe/admin to 1.13.6 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-4q66-g4mm-8rg5 being exploited?
There is no known exploitation of GHSA-4q66-g4mm-8rg5 in the wild and no public exploit code.