Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (2)
| Vulnerability |
Summary |
Aliases |
|
VCID-a3yc-fxa1-gfhy
|
Silverstripe Framework has a XSS vulnerability in HTML editor
### Impact
A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it.
The server-side sanitisation logic has been updated to sanitise against this attack.
### Reported by
James Nicoll from Fujitsu Cyber
### References
- https://www.silverstripe.org/download/security-releases/cve-2025-30148
|
CVE-2025-30148
GHSA-rhx4-hvx9-j387
|
|
VCID-qjgf-hxng-j3g9
|
Silverstripe Framework user enumeration via timing attack on login and password reset forms
### Impact
User enumeration is possible by performing a timing attack on the login or password reset pages with user credentials.
This was originally disclosed in https://www.silverstripe.org/download/security-releases/ss-2017-005/ for CMS 3 but was not patched in CMS 4+
### References
- https://www.silverstripe.org/download/security-releases/ss-2017-005
- https://www.silverstripe.org/download/security-releases/ss-2025-001
|
GHSA-256q-hx8w-xcqx
|