| Package | Affected versions | Patched versions |
|---|---|---|
| silverstripe/framework | ≥ 4.0.0, < 4.11.13 | 4.11.13 |
| framework | ≥ 3.0.0, < 4.11.13 | 4.11.13 |
A malicious content author could add a Javascript payload to the href attribute of a link. A similar issue was identified and fixed via CVE-2022-28803. However, the fix didn't account for the casing of the href attribute. An attacker must have access to the CMS to exploit this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free