CVE-2019-14272: SilverStripe asset-admin Cross-site Scripting (XSS)
Summary
CVE-2019-14272: SilverStripe asset-admin Cross-site Scripting (XSS). Affects silverstripe/framework across 2 version ranges.
>= 4.0.0, < 4.3.5
>= 4.4.0, < 4.4.4
Fixed in 4.3.5 or 4.4.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SilverStripe framework is an open-source PHP web application framework used for building websites and web applications. It provides a flexible and extensible architecture for developers to create and manage content. The asset-admin module is a part of the SilverStripe CMS that allows users to manage files and assets through the CMS interface.
Vulnerability Detail
The SilverStripe asset-admin module version 4.0 is vulnerable to cross-site scripting (XSS) attacks. This vulnerability allows an attacker to inject malicious scripts into file titles managed through the CMS. When the file titles are displayed or rendered, the injected scripts are executed in the context of the user's browser, potentially leading to unauthorized actions or data theft. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.3.54.3.5composer require silverstripe/framework:4.3.5 -
>= 4.4.0, < 4.4.44.4.4composer require silverstripe/framework:4.4.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions mentioned above to mitigate the risk of XSS attacks.
Conclusion
The SilverStripe asset-admin module version 4.0 is vulnerable to cross-site scripting (XSS) attacks. To mitigate this vulnerability, it is crucial to upgrade to the recommended fixed versions: 4.3.5 for version 4.0 and 4.4.4 for version 4.4. Applying these fixes will patch the XSS vulnerability and protect against potential unauthorized actions or data theft. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/framework →
FAQ
This vulnerability allows an attacker to execute malicious scripts in the context of a user's browser, potentially leading to unauthorized actions or data theft.
No, only versions 4.0 and 4.4 of the SilverStripe framework are affected. Versions outside this range are not vulnerable to this specific XSS issue.
There is no known public exploit for this vulnerability at the time of this report. However, it is crucial to apply the recommended fixes to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely. An attacker can inject malicious scripts into file titles through the CMS, and when the files are accessed or rendered, the scripts will be executed in the user's browser.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is still recommended to upgrade to the fixed versions to ensure the security of the asset-admin module.
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
