CVE-2011-4958
published 2014-04-08CVE-2011-4958: Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers…
PriorityP425medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
4.25%
89.8th percentile
Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as demonstrated by a request to (1) admin/reports/, (2) admin/comments/, (3) admin/, (4) admin/show/, (5) admin/assets/, and (6) admin/security/.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| silverstripe | silverstripe | <= 2.3.12 | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
| silverstripe | silverstripe | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
SilverStripe up to 2.4.5 SSViewer.php process cross site scripting (EDB-36226 / SA46390)
vuldb·2026-05-09·CVSS 4.3
CVE-2011-4958 [MEDIUM] SilverStripe up to 2.4.5 SSViewer.php process cross site scripting (EDB-36226 / SA46390)
A vulnerability was found in SilverStripe. It has been classified as problematic. This vulnerability affects the function process of the file SSViewer.php. This manipulation causes cross site scripting.
This vulnerability appears as CVE-2011-4958. The attack may be initiated remotely. In addition, an exploit is available.
Upgrading the affected component is recommended.
GHSA
GHSA-hvm5-xrxv-6g4q: Cross-site scripting (XSS) vulnerability in the process function in SSViewer
ghsa_unreviewed·2022-05-14
CVE-2011-4958 [MEDIUM] CWE-79 GHSA-hvm5-xrxv-6g4q: Cross-site scripting (XSS) vulnerability in the process function in SSViewer
Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as demonstrated by a request to (1) admin/reports/, (2) admin/comments/, (3) admin/, (4) admin/show/, (5) admin/assets/, and (6) admin/security/.
No detection rules found.
No writeups or analysis indexed.
http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6http://osvdb.org/76258http://secunia.com/advisories/46390http://www.rul3z.de/advisories/SSCHADV2011-024.txthttp://www.securityfocus.com/archive/1/520050/100/0/threadedhttps://github.com/silverstripe/sapphire/commit/16c3235https://github.com/silverstripe/sapphire/commit/52a895fhttps://github.com/silverstripe/sapphire/commit/bdd6391http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6http://osvdb.org/76258http://secunia.com/advisories/46390http://www.rul3z.de/advisories/SSCHADV2011-024.txthttp://www.securityfocus.com/archive/1/520050/100/0/threadedhttps://github.com/silverstripe/sapphire/commit/16c3235https://github.com/silverstripe/sapphire/commit/52a895fhttps://github.com/silverstripe/sapphire/commit/bdd6391
2014-04-08
Published