VulnerableCode Package Details - pkg:composer/silverstripe/framework@3.2.0-alpha

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:composer/silverstripe/framework@3.2.0-alpha

purl	pkg:composer/silverstripe/framework@3.2.0-alpha
Tags	Ghost

Next non-vulnerable version	6.2.2
Latest non-vulnerable version	6.2.2
Risk score

Vulnerabilities affecting this package (5)

Advisory	Summary	Fixed in package version
SS-2016-001	XSS in CMSController BackURL A XSS risk exists in the returnURL parameter passed to CMSSecurity/success. An unvalidated url could cause …	3.1.19-rc1 Vulnerable 3.2.4-rc1 Vulnerable 3.3.2-rc1 Vulnerable 3.3.2 Vulnerable 3.1.19 Vulnerable 3.2.4 Vulnerable
SS-2016-006	Missing CSRF protection in login form `LoginForm` calls `disableSecurityToken()`, which causes a "shared host domain" vulnerability.	3.1.19-rc1 Vulnerable 3.2.4-rc1 Vulnerable 3.3.2-rc1 Vulnerable 3.3.2 Vulnerable 3.1.19 Vulnerable 3.2.4 Vulnerable
SS-2016-004	XSS in CMS Edit Page Due to a lack of parameter sanitisation a carefully crafted URL could be used to …	3.1.19-rc1 Vulnerable 3.2.4-rc1 Vulnerable 3.3.2-rc1 Vulnerable 3.3.2 Vulnerable 3.1.19 Vulnerable 3.2.4 Vulnerable
SS-2015-029	CSRF vulnerability in savetreenodes `savetreenode` action does not have sufficient CSRF protection, meaning that in some cases users with CMS …	3.1.19-rc1 Vulnerable 3.2.4-rc1 Vulnerable 3.3.2-rc1 Vulnerable 3.3.2 Vulnerable 3.1.19 Vulnerable 3.2.4 Vulnerable
SS-2016-005	Brute force bypass on default admin Default Administrator accounts were not subject to the same brute force protection afforded to …	3.1.19-rc1 Vulnerable 3.2.4-rc1 Vulnerable 3.3.2-rc1 Vulnerable 3.3.2 Vulnerable 3.1.19 Vulnerable 3.2.4 Vulnerable

This package is not known to fix any advisories.