silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL

MEDIUM 6.1GHSA-r85g-7jpv-8xrx · Published 27/05/2024 · updated 02/12/2024

In short

GHSA-r85g-7jpv-8xrx is a MEDIUM (CVSS 6.1) vulnerability affecting silverstripe/framework.
Fix: update to 3.1.21, 3.2.6, 3.3.4, 3.4.2 or later.

Package	Affected versions	Patched versions
silverstripe/framework Packagist	`≥ 3.1.0-rc1, < 3.1.21≥ 3.2.0-rc1, < 3.2.6≥ 3.3.0-rc1, < 3.3.4≥ 3.4.0-rc1, < 3.4.2`	`3.1.213.2.63.3.43.4.2`

In follow up to SS-2016-001 there is yet a minor unresolved fix to incorrectly encoded URL.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 3.1.0-rc1, < 3.1.21≥ 3.2.0-rc1, < 3.2.6≥ 3.3.0-rc1, < 3.3.4≥ 3.4.0-rc1, < 3.4.2

3.1.213.2.63.3.43.4.2

More vulnerabilities in silverstripe/framework

See all →