CVE-2011-4962

🗓️ 17 Sep 2012 17:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 46 Views🌐 WEB

code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2011-4962	17 Sep 201217:00	–	cvelist
EUVD	EUVD-2022-4010	3 Oct 202520:07	–	euvd
Github Security Blog	Silverstripe CMS Arbitrary Code Execution	17 May 202205:22	–	github
NVD	CVE-2011-4962	17 Sep 201217:55	–	nvd
OSV	GHSA-GV6C-59H4-9PMG Silverstripe CMS Arbitrary Code Execution	17 May 202205:22	–	osv
Prion	Code injection	17 Sep 201217:55	–	prion
RedhatCVE	CVE-2011-4962	22 May 202509:48	–	redhatcve

NVD

Node

silverstripe silverstripeMatch2.4.0

silverstripe silverstripeMatch2.4.1

silverstripe silverstripeMatch2.4.2

silverstripe silverstripeMatch2.4.3

silverstripe silverstripeMatch2.4.4

silverstripe silverstripeMatch2.4.5

Source	Link
github	www.github.com/silverstripe/silverstripe-cms/commit/d15e850
doc	www.doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6
openwall	www.openwall.com/lists/oss-security/2012/04/30/3
openwall	www.openwall.com/lists/oss-security/2012/04/30/1

Parameter	Position	Path	Description	CWE
Cookie	header	code/sitefeatures/PageCommentInterface.php	Remote code execution via deserialization of a crafted cookie during user comment submission.	CWE-20

16 Jun 2026 23:35Current

7.8High risk

Vulners AI Score7.8

CVSS 26.8

EPSS0.03918

CWE-20