CVE-2022-38724

CVE-2022-38724 affects Silverstripe framework ≤ 4.11.0, Silverstripe assets ≤ 1.11.0, and Silverstripe asset-admin ≤ 1.11.0. The root cause is XSS via shortcodes when arbitrary attributes can be added to HTML editor shortcodes, due to missing attribute whitelists in shortcode providers. Reported ...

CVE-2022-29858

The CVE-2022-29858 entry concerns Silverstripe’s assets module up to version 1.10, where improper access control allows publishing protected images by modifying an existing image shortcode in page content. Publicly available connected documents confirm the vulnerable component (silverstripe/asset...