CVE-2022-38462 — Cross-site Scripting in Framework

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.7%
top 28.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Silverstripe Framework
Timeline
Latest updateNov 21
PublishedNov 22

Description

Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDsilverstripe/framework3.0.0 — 3.7.7+1
▶Packagistsilverstripe/framework4.0.0 — 4.11.13

🔴Vulnerability Details

2
GHSA
Reflected XSS in querystring parameters↗2022-11-21
▶
OSV
Reflected XSS in querystring parameters↗2022-11-21
▶