Stored XSS using uppercase characters in HTMLEditor

MEDIUM 5.4CVE-2022-37430 · GHSA-qw4w-vq8v-2wcv · Published 23/11/2022 · updated 17/06/2026

In short

CVE-2022-37430 is a MEDIUM (CVSS 5.4) vulnerability affecting silverstripe/framework, framework (silverstripe).
Chance of exploitation in the next 30 days (EPSS): 0.57%, higher than 47.2% of all vulnerabilities.
Fix: update to 4.11.13 or later.

Package	Affected versions	Patched versions
silverstripe/framework Packagist	`≥ 4.0.0, < 4.11.13`	`4.11.13`
framework silverstripe	`≥ 3.0.0, < 4.11.13`	`4.11.13`

Description

A malicious content author could add a Javascript payload to the href attribute of a link. A similar issue was identified and fixed via CVE-2022-28803. However, the fix didn't account for the casing of the href attribute. An attacker must have access to the CMS to exploit this issue.

NVD description

Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).

References

nvd.nist.gov/vuln/detail/CVE-2022-37430 · ADVISORY
forum.silverstripe.org/c/releases · WEB
FriendsOfPHP/security-advisories · WEB
silverstripe.org/blog/tag/release · WEB
silverstripe.org/download/security-releases · WEB
silverstripe.org/download/security-releases/cve-2022-37430 · WEB
silverstripe.org/download/security-releases · Vendor Advisory
silverstripe.org/download/security-releases/CVE-2022-37430 · Vendor Advisory

More vulnerabilities in silverstripe/framework

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

silverstripe/framework

Packagist

≥ 4.0.0, < 4.11.13

4.11.13

framework

silverstripe

≥ 3.0.0, < 4.11.13

4.11.13

Description

NVD description

Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).

More vulnerabilities in silverstripe/framework

See all →