github.com
https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-008-1.yaml GHSA-M5Q3-MVCR-GC5M
silverstripe/framework BackURL validation bypass with malformed URLs
Description
A carefully constructed malformed URL can be used to circumvent the offsite redirection protection used on `BackURL` parameters. This could lead to users entering sensitive data in malicious websites instead of the intended one.
Description source: GitHub Advisory
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
silverstripe/frameworkBrowse Packagist / silverstripe/framework | GitHub Advisory | 4.0.0-rc1 to < 4.0.4 · Fixed in 4.0.4 | affected |
| 4.1.0-rc1 to < 4.1.1 · Fixed in 4.1.1 | affected |
References
4github.com
https://github.com/silverstripe/silverstripe-framework github.com
https://github.com/silverstripe/silverstripe-framework/commit/9053014a7e2eba28d000881e0bb3cc1d6e6b2eea silverstripe.org
https://www.silverstripe.org/download/security-releases/ss-2018-008