| Package | Affected versions | Patched versions |
|---|---|---|
| silverstripe/versioned-admin | ≥ 1.0.0, < 1.11.1 | 1.11.1 |
| framework | ≥ 1.0.0, < 1.11.1 | 1.11.1 |
A malicious content author could add a Javascript payload to a page's meta description and get it executed in the versioned history compare view.
This vulnerability requires access to the CMS to be deployed. The attacker must then convince a privileged user to access the version history for that page.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free