CVE-2012-0976

SilverStripe 2.4.6 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter. NOTE: some of these details are obtained from third party information.

References (11)

[Various Sources] http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13

[Various Sources] http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7

[Exploit] http://packetstormsecurity.org/files/view/109210/silverstripecmspage-xss.txt

[Vendor Advisory] http://secunia.com/advisories/47812

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/51761

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/72820

[Patch] https://github.com/silverstripe/sapphire/commit/252e187

[Patch] https://github.com/silverstripe/sapphire/commit/475e077

[Patch] https://github.com/silverstripe/sapphire/commit/5fe7091

[Mailing List] http://www.openwall.com/lists/oss-security/2012/04/30/3

[Third Party Advisory, VDB Entry] http://osvdb.org/78677

Scores

EPSS 0.0038

EPSS Percentile 59.2%

Classification

CWE

CWE-79

Status published

Affected Products (2)

silverstripe/silverstripe

n/a/n/a

Timeline

Published Feb 02, 2012

Tracked Since Feb 18, 2026