CVE-2021-36150

CVE-2021-36150 affects the SilverStripe Framework up to version 4.8.1, which allows Cross-Site Scripting (XSS). The root cause described across connected sources is insufficient validation of input/data, enabling script execution in the context of vulnerable applications. Impact is limited to bro...

PT-2021-21140 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: SilverStripe Framework versions prior to 4.8.2 Description: The issue allows for XSS. Recommendations: For versions prior to 4.8.2, update to version 4.8.2 or later to resolve the issue...

XML External Entitty (XXE)

silverstripe/framework is vulnerable to XML external entity XXE attacks. The loading of external entities and DTDs are not disabled and allows an attacker to perform server-side request forgery SSRF attacks or retrieve confidential system files via a malicious XML document...

PT-2020-18974 · Silverstripe · Silverstripe

Name of the Vulnerable Software and Affected Versions: SilverStripe versions through 4.5.0 Description: A specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a SilverStripe application, without revealing the...

Denial Of Service (DoS)

silverstripe/framework is susceptible to denial of service DoS. The attack exists when an authenticated user with administrative privileges are tricked to open maintenance services in the form of URL Variable Tools such as ?flush, ?isDev and ?isTest or development admin urls /dev/...

Privilege Escalation

silverstripe/framework is vulnerable to privilege escalation. Due to incorrectly shared caches between files and page content, CMS users with different permissions for these object types could gain more access than defined by the system...

Session Fixation

silverstripe/framework is vulnerable to session fixation. The application does not regenerate the session ID in the Change Password function, allowing a remote attacker with physical access to a victim's node to perform session fixation in the Change Password form...

Information Disclosure

silverstripe/framework is vulnerable to information disclosure. The versions files leaks unpublished versions of files publicly to those users who can guess the URL...

Cross-Site Scripting (XSS)

silverstripe/framework is susceptible to cross-site scripting XSS attacks. The attacks are possible because it does not escape the backURL parameter in CMSSecurity.php...

Cross-Site Scripting (XSS)

silverstripe/framework is vulnerable to cross-site scripting XSS attacks. The attacker can inject arbitrary code via the rewritehashlinks parameter...

Cross-site Scripting (XSS)

silverstripe/framework is vulnerable to cross-site scripting XSS attacks. Using the adminusername or the adminpassword parameters in install.php, attackers can inject web script or HTML...

SilverStripe CMS & Framework Cross-Site Scripting Vulnerability

SilverStripe CMS & Framework is New Zealand SilverStripe company's set of open source programming framework and content management system CMS. A cross-site scripting vulnerability exists in SilverStripe CMS & Framework versions prior to 3.1.16 and 3.2.x prior to 3.2.1, which can be exploited by...

Multiple Cross-Site Scripting Vulnerabilities in SilverStripe CMS & Framework

SilverStripe CMS & Framework is a CMS content management system. SilverStripe CMS & Framework has multiple cross-site scripting vulnerabilities that can be exploited by attackers to inject arbitrary web script or HTML...

SilverStripe CMS & Framework Open Redirect Vulnerability

SilverStripe CMS & Framework is a CMS content management system. An open redirect vulnerability exists in SilverStripe CMS & Framework version 3.1.13. A remote attacker can exploit the vulnerability by using the URL in the 'returnURL' parameter of the dev/build URI to redirect the user to an...

CVE-2015-5062

Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter to dev/build...

SilverStripe CMS Unvalidated Redirect & XSS vulnerabilities

Credits: hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-SILVERSTRIPE0607.txt Vendor: ================================ http://www.silverstripe.org/software/download Product: ================================ SilverStripe CMS & Framework v3.1.13...