Package Instance

XSS In CMSSecurity BackURL
In follow up to SS-2016-001 there is yet a minor unresolved fix to incorrectly encoded URL.

Information Exposure
Response discrepancy in the login and password reset forms in SilverStripe CMS allows remote attackers to enumerate users via timing attack.

Cross-site Scripting
In SilverStripe asset-admin, there is XSS in file titles managed through the CMS.

Improper Privilege Management
In SilverStripe, there is access escalation for CMS users with limited access through permission cache pollution.

Cross-site Scripting
SilverStripe CMS has an XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an `admin/assets/add` pathname.

Cross-site Scripting
There is an XSS in SilverStripe CMS.

Session Fixation
SilverStripe allows session fixation in the "change password" form.

ReadOnly transformation for formfields exploitable
Form fields returning `isReadonly()` as true are vulnerable to reflected XSS injections. This includes `ReadonlyField`, `LookupField`, `HTMLReadonlyField`, as well as special purpose fields like `TimeField_Readonly`. Values submitted to through these form fields are not filtered out from the form session data, and might be shown to the user depending on the form behaviour. For example, form validation errors cause the form to re-render with previously submitted values by default. SilverStripe forms automatically load values from request data (GET and POST), which enables malicious use of URLs if your form uses these fields and does not overwrite data on form construction. Readonly and disabled form fields are already filtered out in `saveInto()`, so maliciously submitted data on these fields does not make it into the database unless you are accessing form values directly in your saving logic.

Files or Directories Accessible to External Parties
In SilverStripe, there is broken access control on files.

Cross-site Scripting
SilverStripe has Flash Clipboard Reflected XSS.