Silverstripe admin XSS Vulnerability via WYSIWYG editor · GHSA-779c-7w4p-2c4g · GitHub Advisory Database · GitHub

Silverstripe admin XSS Vulnerability via WYSIWYG editor

Low severity GitHub Reviewed Published May 22, 2024 to the GitHub Advisory Database • Updated May 22, 2024

Package

silverstripe/admin (Composer)

Affected versions

>= 1.0.3, < 1.0.4

>= 1.1.0, < 1.1.1

Patched versions

1.0.4

1.1.1

Description

It is possible for a bad actor with access to the CMS to make use of onmouseover or onmouseout attributes in the WYSIWYG editor to embed malicious javascript.

References

Published to the GitHub Advisory Database May 22, 2024

Reviewed May 22, 2024

Last updated May 22, 2024

Severity

Low

3.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N