| Package | Affected versions | Patched versions |
|---|---|---|
| silverstripe/framework | ≥ 4.0.0, < 4.11.13 | 4.11.13 |
| framework | ≥ 3.0.0, < 4.11.13 | 4.11.13 |
A malicious content author could add a JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters.
An attacker must have access to the CMS to exploit this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free