Silverstripe XSS Vulnerabilities

보통 4.3CVE-2012-4968 · GHSA-v358-rvxr-wffx · Published 17/09/2012 · updated 16/06/2026

요약

CVE-2012-4968은(는) silverstripe/framework, silverstripe (silverstripe)에 영향을 주는 보통 (CVSS 4.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.9%, 전체 취약점의 79.9%보다 높음.
조치: 2.3.13, 2.4.7 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
silverstripe/framework Packagist	`≥ 2.3, < 2.3.13≥ 2.4, < 2.4.7`	`2.3.132.4.7`
silverstripe silverstripe	`= 2.3.0= 2.3.1= 2.3.10= 2.3.11= 2.3.12= 2.3.2= 2.3.3= 2.3.4= 2.3.5= 2.3.6= 2.3.7= 2.3.8= 2.3.9= 2.4.0= 2.4.1= 2.4.2= 2.4.3= 2.4.5= 2.4.6`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via

a crafted string to the AbsoluteLinks
BigSummary
ContextSummary
EscapeXML
FirstParagraph
FirstSentence
Initial
LimitCharacters
LimitSentences
LimitWordCount
LimitWordCountXML
Lower
LowerCase
NoHTML
Summary
Upper
UpperCase, or
URL method in a template,

different vectors than CVE-2012-0976.

NVD description

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted string to the AbsoluteLinks, (2) BigSummary, (3) ContextSummary, (4) EscapeXML, (5) FirstParagraph, (6) FirstSentence, (7) Initial, (8) LimitCharacters, (9) LimitSentences, (10) LimitWordCount, (11) LimitWordCountXML, (12) Lower, (13) LowerCase, (14) NoHTML, (15) Summary, (16) Upper, (17) UpperCase, or (18) URL method in a template, different vectors than CVE-2012-0976.

References

nvd.nist.gov/vuln/detail/CVE-2012-4968 · ADVISORY
silverstripe/sapphire commit 0085876 · WEB
silverstripe/silverstripe-framework commit 0085876 · WEB
silverstripe/silverstripe-framework commit 15e9e05 · WEB
silverstripe/silverstripe-framework · PACKAGE
doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13 · WEB
doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7 · WEB
openwall.com/lists/oss-security/2012/04/30/1 · WEB
openwall.com/lists/oss-security/2012/04/30/3 · WEB

silverstripe/framework의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

silverstripe/framework

Packagist

≥ 2.3, < 2.3.13≥ 2.4, < 2.4.7

2.3.132.4.7

silverstripe

= 2.3.0= 2.3.1= 2.3.10= 2.3.11= 2.3.12= 2.3.2= 2.3.3= 2.3.4= 2.3.5= 2.3.6= 2.3.7= 2.3.8= 2.3.9= 2.4.0= 2.4.1= 2.4.2= 2.4.3= 2.4.5= 2.4.6

No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via

a crafted string to the AbsoluteLinks
BigSummary
ContextSummary
EscapeXML
FirstParagraph
FirstSentence
Initial
LimitCharacters
LimitSentences
LimitWordCount
LimitWordCountXML
Lower
LowerCase
NoHTML
Summary
Upper
UpperCase, or
URL method in a template,

different vectors than CVE-2012-0976.

NVD description

silverstripe/framework의 다른 취약점

모두 보기 →