CVE-2010-1593

SilverStripe <2.3.5 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).

References (13)

[Exploit] http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0450.html

[Patch] http://groups.google.com/group/silverstripe-announce/browse_thread/thread/f51749342eee9456

[Exploit, Patch] http://open.silverstripe.org/changeset/97074

[Vendor Advisory] http://secunia.com/advisories/38290

[Vendor Advisory] http://secunia.com/advisories/38347

[Patch] http://www.securityfocus.com/bid/37923

[Patch, Vendor Advisory] http://www.silverstripe.org/security-releases/

[Third Party Advisory] http://open.silverstripe.org/wiki/ChangeLog/2.3.5

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/509139/100/0/threaded

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/55838

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/55839

[Third Party Advisory, VDB Entry] http://osvdb.org/61921

[Third Party Advisory, VDB Entry] http://osvdb.org/61923

Scores

EPSS 0.0058

EPSS Percentile 68.6%

Classification

CWE

CWE-79

Status published

Affected Products (22)

silverstripe/silverstripe < 2.3.4

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

... and 7 more

Timeline

Published Apr 28, 2010

Tracked Since Feb 18, 2026