Advisory details:
github_osv / GHSA-jqp8-v74p-g8px
| Advisory ID | github_osv/GHSA-jqp8-v74p-g8px |
| Aliases | |
| Summary | Silverstripe XSS in Director::force_redirect() A low level XSS vulnerability has been found in the Framework affecting http redirection via the Director::force_redirect method. Attempts to redirect to a url may generate HTML which is not safely escaped, and may pose a risk of XSS in some environments. This vulnerability is marked low as it is difficult to exploit, as any injected HTML will only be returned from the server if the Location HTTP header is also sent, meaning that any user browsing the site would not be exposed to the body of the response before their browser redirects them. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 5.5 |
| Risk | 2.8 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 6.1 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-jqp8-v74p-g8px/GHSA-jqp8-v74p-g8px.json |
| generic_textual | MODERATE |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.