Silverstripe CMS Arbitrary Code Execution

中危 6.8CVE-2011-4962 · GHSA-gv6c-59h4-9pmg · Published 17/09/2012 · updated 16/06/2026

要点

CVE-2011-4962 是影响 silverstripe/cms, silverstripe (silverstripe) 的中危 (CVSS 6.8)漏洞。
未来 30 天内被利用的概率（EPSS）：3.9%，高于 90.3% 的漏洞。
修复：升级到 2.4.6 或更高版本。

Package	Affected versions	Patched versions
silverstripe/cms Packagist	`≥ 2.4.0, < 2.4.6`	`2.4.6`
silverstripe silverstripe	`= 2.4.0= 2.4.1= 2.4.2= 2.4.3= 2.4.4= 2.4.5`	No fix yet

Description

code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized.

NVD description

code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized.

References

nvd.nist.gov/vuln/detail/CVE-2011-4962 · ADVISORY
silverstripe/silverstripe-cms commit d15e850 · WEB
silverstripe/silverstripe-cms · PACKAGE
web.archive.org/web/20120621234353/http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6 · WEB
openwall.com/lists/oss-security/2012/04/30/1 · WEB
openwall.com/lists/oss-security/2012/04/30/3 · WEB
doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6 · Vendor Advisory
silverstripe/silverstripe-cms commit d15e850 · Exploit

silverstripe/cms 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free