CVE-2010-4823

SilverStripe <2.3.10-2.4.4 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the httpError method in sapphire/core/control/RequestHandler.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when custom error handling is not used, allows remote attackers to inject arbitrary web script or HTML via "missing URL actions."

References (10)

[Exploit, Patch, Vendor Advisory] http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4

[Exploit, Patch] http://open.silverstripe.org/changeset/114444

[Vendor Advisory] http://secunia.com/advisories/42346

[Third Party Advisory, VDB Entry] http://www.osvdb.org/69886

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/63988

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/45367

[Mailing List] http://www.openwall.com/lists/oss-security/2011/01/03/12

[Mailing List] http://www.openwall.com/lists/oss-security/2012/04/30/1

[Mailing List] http://www.openwall.com/lists/oss-security/2012/04/30/3

[Mailing List] http://www.openwall.com/lists/oss-security/2012/05/01/3

Scores

EPSS 0.0073

EPSS Percentile 72.4%

Classification

CWE

CWE-79

Status published

Affected Products (15)

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

silverstripe/silverstripe

n/a/n/a

Timeline

Published Sep 17, 2012

Tracked Since Feb 18, 2026