| Package | Affected versions | Patched versions |
|---|---|---|
| silverstripe/framework | ≥ 4.0.0, < 4.11.13 | 4.11.13 |
| framework | ≥ 3.0.0, ≤ 3.7.7< 4.11.13 | 4.11.13 |
An attacker could inject a XSS payload in a Silverstripe CMS response by carefully crafting a return URL on a /dev/build or /Security/login request.
To exploit this vulnerability, an attacker would need to convince a user to follow a link with a malicious payload.
This will only affect projects configured to output PHP warnings to the browser. By default, Silverstripe CMS will only output PHP warnings if your SS_ENVIRONMENT_TYPE environment variable is set to dev. Production sites should always set SS_ENVIRONMENT_TYPE to live.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free