GHSA-jxcx-3h54-qqxx SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE
Attackers can execute scripts in SilverStripe CMS 4 admin interfaces via inherited TinyMCE XSS flaws, potentially stealing data or hijacking accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-jxcx-3h54-qqxx?
GHSA-jxcx-3h54-qqxx is a cross-site scripting vulnerability in silverstripe/admin, published on 23 Aug 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin.
Only Silverstripe CMS 4 is affected by these vulnerabilities. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin.
Silverstripe CMS 5 is not affected by these vulnerabilities because it uses TinyMCE 6.
Which versions are affected by GHSA-jxcx-3h54-qqxx?
2 open source packages ship an affected version, including silverstripe/admin.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/admin Packagist | From 1.0.0 | 1.13.6 |
silverstripe/admin Packagist | From 1.0.0 | 1.13.6 |
How do I fix GHSA-jxcx-3h54-qqxx?
Upgrade silverstripe/admin to 1.13.6 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-jxcx-3h54-qqxx being exploited?
There is no known exploitation of GHSA-jxcx-3h54-qqxx in the wild and no public exploit code.