GHSA-j982-5jv7-v43r Silverstripe Form field validation message XSS vulnerability
Attackers can inject malicious scripts via form validation messages in Silverstripe, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-j982-5jv7-v43r?
GHSA-j982-5jv7-v43r is a cross-site scripting vulnerability in silverstripe/framework, published on 23 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A high level XSS risk has been identified in the encoding of validation messages in certain FormField classes.
Certain fields such as the NumericField and DropdownField have been identified, but any form field which presents any invalid content as a part of its validation response will be at risk.
Which versions are affected by GHSA-j982-5jv7-v43r?
4 open source packages ship an affected version, including silverstripe/framework.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | From 3.0.0 | 3.1.16 |
silverstripe/framework Packagist | From 3.0.0 | 3.1.16 |
silverstripe/framework Packagist | From 3.2.0 | 3.2.1 |
silverstripe/framework Packagist | From 3.2.0 | 3.2.1 |
How do I fix GHSA-j982-5jv7-v43r?
Upgrade silverstripe/framework to a fixed version for your release line: 3.1.16 or 3.2.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-j982-5jv7-v43r being exploited?
There is no known exploitation of GHSA-j982-5jv7-v43r in the wild and no public exploit code.