Cross-site Scripting (XSS)

silverstripe/framework is vulnerable to Cross-site Scripting XSS. The vulnerability is due to an unvalidated returnURL parameter in the dev/build endpoint, which can cause users to be redirected to unverified third-party URLs...

silverstripe/framework member disclosure in login form

There is a user ID enumeration vulnerability in our brute force error messages. - Users that don't exist in will never get a locked out message - Users that do exist, will get a locked out message This means an attacker can infer or confirm user details that exist in the member table. This issue...

GHSA-468J-6JRC-2RJX silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField`

List of key / value pairs assigned to OptionsetField or CheckboxSetField do not have a default casting assigned to them. The effect of this is a potential XSS vulnerability in lists where either key or value contain unescaped HTML...

silverstripe/framework's `Member.Name` is not escaped

The core template framework/templates/Includes/GridFieldprint.ss uses "Printed by $Member.Name". If the currently logged in members first name or surname contain XSS, this prints the raw HTML out, because Member-getName just returns the raw FirstName + Surname as a string, which is injected...

GHSA-5R8W-66HQ-RC39 silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled

If remember me is on and users log in with the box checked, if the developer then disabled "remember me" function, any pre-existing cookies will continue to authenticate users...

silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled

If remember me is on and users log in with the box checked, if the developer then disabled "remember me" function, any pre-existing cookies will continue to authenticate users...

GHSA-52CX-HPC5-CXWC silverstripe/framework missing ACL on reports

The SSReport, and the reports CMS section only checks canView when listing the reports that can be viewed by the current user. It does not and should perform canView checks when the report is actually viewed, so if you know the URL to a report and can otherwise access the Reports section of the...

silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()`

After performing a password reset, ChangePasswordForm::doChangePassword logs in the user without checking Member::canLogIn. This presents an issue for sites that are using the extension point in that method to deny access to users for example members that have not been “approved”, or members that...

GHSA-F3WP-XPV2-6VMG silverstripe/framework password encryption salt not updated

When a user changes their password, the internal salt used for hashing their password is not updated. Although this is not considered a security vulnerability, this behaviour has been improved to ensure the salt is reset on change of password...

Improper URL Sanitization

silverstripe/framework is vulnerable to Improper URL Sanitization. The vulnerability is due to a lack of server-side URL sanitization in the "Add from URL" function, allowing potentially dangerous URLs to be processed...

Open Redirect

silverstripe/framework is vulnerable to Open Redirect. The vulnerability is due to improper handling of login URLs, allowing attackers to redirect successful logins to external sites...

Cross Site Scripting (XSS)

silverstripe/framework is vulnerable to Cross Site Scripting. The vulnerability is due to a lack of adminusername and adminpassword sanitation within the setup form...

Cross-site Scripting(XSS)

silverstripe/framework is vulnerable to Cross-site Scripting XSS. The vulnerability is caused due to the lack of proper sanitization or encoding of user-input data when it is displayed in TreeDropdownField and TreeMultiSelectField, which allows an attacker to execute malicious JavaScript code...

Cross-site Scripting (XSS)

silverstripe/framework is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper encoding of validation messages in certain FormField classes, which can present invalid content as part of the validation response resulting in XSS...

Cross-Site Scripting (XSS)

silverstripe/framework is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of parameter sanitization, allowing the injection of arbitrary HTML through crafted URLs...

Cross-Site Request Forgery (CSRF)

silverstripe/framework is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to a lack of proper CSRF token verification in gridFieldAlterAction submissions, which allows attackers to trick users with CMS access into posting unspecified data from external websites...

PT-2024-40391 · Packagist · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue arises after a password reset, where the ChangePasswordForm::doChangePassword function logs in the user without checking Member::canLogIn. This...

PT-2024-40165 · Packagist · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue allows user enumeration through a timing attack on the login or password reset pages using user credentials. Recommendations: At the moment, there is no information about ...

PT-2024-40322 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: silverstripe/framework affected versions not specified Description: The issue concerns an XSS vulnerability in the Page name of silverstripe/framework. It can be triggered by a payload such as ", which results in an XSS alert. Recommendations...

PT-2024-40363 · Packagist · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: A maliciously crafted URL can bypass the offsite redirection protection for BackURL parameters, potentially leading to users entering sensitive data on malicious websites instead of the...