CVE-2020-25817: SilverStripe XXE Vulnerability in… – CVSS 4.8 · Watchpost

← Tất cả lỗ hổng

SilverStripe XXE Vulnerability in CSSContentParser

TRUNG BÌNH 4.8CVE-2020-25817 · BIT-silverstripe-2020-25817 · GHSA-3vjc-5x79-m9r8 · Công bố 08/06/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-25817 là lỗ hổng mức TRUNG BÌNH (CVSS 4.8) ảnh hưởng silverstripe/framework, silverstripe (silverstripe).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.82%, cao hơn 57.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.7.4, 4.6.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
silverstripe/framework Packagist	`≥ 4.0.0, < 4.7.4`	`4.7.4`
silverstripe silverstripe	`= 4.6.0< 4.6.0`	`4.6.0`

Mô tả

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving external or user submitted data in custom project code, it can lead to vulnerabilities such as XSS on HTML output rendered through this custom code. This is now mitigated by disabling external entities during parsing. (The correct CVE ID year is 2020 [CVE-2020-25817, not CVE-2021-25817]).

Mô tả của NVD

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving external or user submitted data in custom project code, it can lead to vulnerabilities such as XSS on HTML output rendered through this custom code. This is now mitigated by disabling external entities during parsing. (The correct CVE ID year is 2020 [CVE-2020-25817, not CVE-2021-25817]).

Tham khảo

nvd.nist.gov/vuln/detail/CVE-2020-25817 · ADVISORY
forum.silverstripe.org/c/releases · WEB
silverstripe/silverstripe-framework · PACKAGE
silverstripe.org/blog/tag/release · WEB
silverstripe.org/download/security-releases · WEB
silverstripe.org/download/security-releases/cve-2021-25817 · WEB
silverstripe.org/download/security-releases · Vendor Advisory
silverstripe.org/download/security-releases/cve-2020-25817 · Broken Link

Lỗ hổng khác của silverstripe/framework

Xem tất cả →

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí