9 matches found
Silverstripe HtmlEditor embed url sanitisation
"Add from URL" doesn't clearly sanitise URL server side HtmlEditorFieldToolbar has an action HtmlEditorFieldToolbarviewfile, which gets called by the CMS when adding a media "from a URL" i.e. via oembed. This action gets the URL to add in the GET parameter FileURL. However it doesn't do any URL...
PT-2023-12189 · Cockpit · Cockpit
Name of the Vulnerable Software and Affected Versions: Cockpit versions 0.12.2 and prior Description: Cockpit is a content management system that allows addition of content management functionality to any site. In the affected versions, bad HTML sanitization in htmleditor.js may lead to cross-sit...
Stored XSS using HTMLEditor
A malicious content author could add a JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters. An attacker must have access to the CMS to exploit this issue...
GHSA-WC6R-4GGC-79W5 Stored XSS using HTMLEditor
A malicious content author could add a JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters. An attacker must have access to the CMS to exploit this issue...
Stored XSS using uppercase characters in HTMLEditor
A malicious content author could add a Javascript payload to the href attribute of a link. A similar issue was identified and fixed via CVE-2022-28803. However, the fix didn't account for the casing of the href attribute. An attacker must have access to the CMS to exploit this issue...
GHSA-QW4W-VQ8V-2WCV Stored XSS using uppercase characters in HTMLEditor
A malicious content author could add a Javascript payload to the href attribute of a link. A similar issue was identified and fixed via CVE-2022-28803. However, the fix didn't account for the casing of the href attribute. An attacker must have access to the CMS to exploit this issue...
CVE-2022-37430 - Stored XSS using uppercase characters in HTMLEditor
More info at https://www.silverstripe.org/download/security-releases/cve-2022-37430...