CVE-2011-4962 — Improper Input Validation in CMS

CWE-20 — Improper Input ValidationCWE-915 — Improperly Controlled Modification of Dynamically-Determined Object AttributesCWE-502 — Deserialization of Untrusted Data4 documents4 sources
Severity
6.8MEDIUMNVD
EPSS
2.7%
top 14.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Silverstripe CMSSilverstripe
Timeline
PublishedSep 17
Latest updateMay 17

Description

code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages2 packages

▶Packagistsilverstripe/cms2.4.0 — 2.4.6
▶NVDsilverstripe/silverstripe6 versions+5

Patches

Patch: www.openwall.com ↗Patch: github.com ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

2
OSV
Silverstripe CMS Arbitrary Code Execution↗2022-05-17
▶
GHSA
Silverstripe CMS Arbitrary Code Execution↗2022-05-17
▶

📐Framework References

1
CWE
Improperly Controlled Modification of Dynamically-Determined Object Attributes↗
▶