Silverstripe framework is vulnerable to XSS in install.php

2024-05-2317:27:19

CWE-79

GitHub Advisory Database

github.com

silverstripe framework

xss

vulnerability

installation

parameters

setup form

3.1.14

stable

existing users

production server

software

6.9 Medium

AI Score

Confidence

Low

During installation, certain parameters (admin_username and admin_password) are not escaped in the setup form.

This issue is resolved in 3.1.14 stable, although existing users are advised to remove this file prior to deploying to a production server.

Affected configurations

Vulners

Node

silverstripeframeworkRange<3.1.14

CPENameOperatorVersion
silverstripe/frameworklt3.1.14

CPE	Name	Operator	Version
	silverstripe/framework	lt	3.1.14

github.com/advisories/GHSA-mqf5-275h-gf6r

github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-016-1.yaml

github.com/silverstripe/silverstripe-framework/commit/4c73721bab0d543eee6137e3c00aa8ec727e95d1

www.silverstripe.org/software/download/security-releases/ss-2015-016

6.9 Medium

AI Score

Confidence

Low