Package Instance

Cross-site Scripting
In SilverStripe asset-admin, there is XSS in file titles managed through the CMS.

Improper Privilege Management
In SilverStripe, there is access escalation for CMS users with limited access through permission cache pollution.

Session Fixation
SilverStripe allows session fixation in the "change password" form.

Files or Directories Accessible to External Parties
In SilverStripe, there is broken access control on files.

Cross-site Scripting
SilverStripe has Flash Clipboard Reflected XSS.

Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery (CSRF) Protection Bypass in GraphQL.

Cross-site Scripting
In SilverStripe, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted login form URLs.

Uncontrolled Resource Consumption
SilverStripe allows a Denial of Service on flush and development URL tools.

Information Exposure
SilverStripe has incorrect access control for protected files uploaded via `Upload::loadIntoFile()`. An attacker may be able to guess a filename in `silverstripe/assets` via the `AssetControlExtension`.

silverstripe/framework users inadvertently passing sensitive data to LoginAttempt
All user login attempts are logged in the database in the LoginAttempt table. However, this table contains information in plain text, and may possible contain sensitive information, such as user passwords mis-typed into the username field.

In order to address this a one-way hash is applied to the Email field before being stored.

silverstripe/framework SQL injection in full text search
When performing a fulltext search in SilverStripe 4.0.0 the 'start' querystring parameter is never escaped safely. This exposes a possible SQL injection vulnerability.

The issue exists in 3.5 and 3.6 but is less vulnerable, as SearchForm sanitises these variables prior to passing to mysql.