CVE-2022-28803: Stored XSS in SilverStripe Framework
Summary
CVE-2022-2880: Incorrect sanitization of forwarded query parameters in net/http/httputil. Affects stdlib across 2 version ranges.
< 1.18.7
>= 1.19.0-0, < 1.19.2
Fixed in 1.18.7 or 1.19.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2022-2880 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SilverStripe Framework is a PHP web application framework used for building websites and web applications. It provides a flexible and extensible architecture for developers to create and manage content-driven websites. The framework is widely used and has a large community of developers contributing to its development and maintenance. However, versions of SilverStripe Framework prior to 4.10.9 are vulnerable to a stored cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The vulnerability in SilverStripe Framework allows an authenticated CMS user to inject malicious code into the href attribute of an HTML hyperlink. This can be done by making a XMLHttpRequest (XHR) request and adding the link tags with the malicious code to website content. When other users view the affected website and click on the manipulated hyperlink, the injected code will be executed in their browsers, potentially leading to unauthorized actions, data theft, or further exploitation of the user's session. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.18.71.18.7go get stdlib@v1.18.7 -
>= 1.19.0-0, < 1.19.21.19.2go get stdlib@v1.19.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version of SilverStripe Framework is not immediately feasible, a temporary workaround is to manually sanitize and validate any user-generated content that is added to the website via XMLHttpRequest. This can be done by implementing input validation and output encoding techniques to prevent the execution of malicious code. Here is an example of how to sanitize user-generated content in PHP:
$content = $_POST['content'];
$sanitizedContent = htmlspecialchars($content);
// Use $sanitizedContent in the website's output
By sanitizing the user-generated content, the risk of XSS attacks can be significantly reduced.
Conclusion
In conclusion, SilverStripe Framework versions prior to 4.10.9 are vulnerable to a stored XSS vulnerability that allows authenticated CMS users to inject malicious code into hyperlinks. Upgrading to the latest version of the framework is the recommended solution to fix this vulnerability. In the meantime, implementing input validation and output encoding techniques can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability allows an authenticated CMS user to inject malicious code into hyperlinks on the website. When other users click on these manipulated hyperlinks, the injected code can be executed in their browsers, potentially leading to unauthorized actions, data theft, or further exploitation of their sessions.
Only authenticated CMS users with the necessary permissions can exploit this vulnerability. Regular website visitors or unauthenticated users do not have the ability to inject the malicious code.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is important to promptly apply the recommended fixes to prevent any potential exploitation.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
You can find more information about this vulnerability, including the CVE identifier (CVE-2022-28803), on the Vulert website (https://vulert.com/scanner). Vulert provides real-time monitoring and alerts for open-source vulnerabilities, helping you stay informed and take necessary actions to secure your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
