Silverstripe CMS XSS Vulnerability

MEDIUM 6.1CVE-2015-8606 · GHSA-gvc8-xjfp-6569 · Published 13/04/2016 · updated 17/06/2026

In short

CVE-2015-8606 is a MEDIUM (CVSS 6.1) vulnerability affecting silverstripe/cms, silverstripe (silverstripe).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.8% of all vulnerabilities.
Fix: update to 3.2.1, 3.1.16 or later.

Package	Affected versions	Patched versions
silverstripe/cms Packagist	`≥ 3.2.0, < 3.2.1< 3.1.16`	`3.2.13.1.16`
silverstripe silverstripe	`= 3.2.0≤ 3.1.15`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.0 before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.

NVD description

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.

References

nvd.nist.gov/vuln/detail/CVE-2015-8606 · ADVISORY
cybersecurityworks.com/zerodays/cve-2015-8606-silverstripe.html · WEB
silverstripe/silverstripe-cms · PACKAGE
seclists.org/fulldisclosure/2015/Dec/55 · WEB
openwall.com/lists/oss-security/2015/12/17/1 · WEB
openwall.com/lists/oss-security/2015/12/17/11 · WEB
openwall.com/lists/oss-security/2015/12/18/5 · WEB
silverstripe.org/download/security-releases/ss-2015-026 · WEB

More vulnerabilities in silverstripe/cms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

silverstripe/cms

Packagist

≥ 3.2.0, < 3.2.1< 3.1.16

3.2.13.1.16

silverstripe

= 3.2.0≤ 3.1.15

No fix yet

Description

NVD description

More vulnerabilities in silverstripe/cms

See all →