Silverstripe admin XSS Vulnerability via WYSIWYG editor
Summary
GHSA-779c-7w4p-2c4g: Silverstripe admin XSS Vulnerability via WYSIWYG editor. Affects silverstripe/admin across 2 version ranges.
>= 1.0.3, < 1.0.4
>= 1.1.0, < 1.1.1
Fixed in 1.0.4 or 1.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Silverstripe admin is a package available on Packagist that provides a content management system (CMS) for Silverstripe websites. It includes a WYSIWYG editor that allows users to create and edit content. This vulnerability affects versions 1.0.3 to 1.0.4 and 1.1.0 to 1.1.1 of the package.
Vulnerability Detail
The vulnerability in Silverstripe admin allows a malicious actor with access to the CMS to exploit the onmouseover or onmouseout attributes in the WYSIWYG editor to inject and execute malicious JavaScript code. This can lead to various attacks, such as cross-site scripting (XSS), where the attacker can steal sensitive information or perform actions on behalf of the user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.3, < 1.0.41.0.4composer require silverstripe/admin:1.0.4 -
>= 1.1.0, < 1.1.11.1.1composer require silverstripe/admin:1.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the Silverstripe admin package.
Conclusion
The Silverstripe admin package is vulnerable to an XSS vulnerability via the WYSIWYG editor. Upgrading to the latest version of the package is necessary to mitigate this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for silverstripe/admin →
FAQ
Silverstripe admin is a package that provides a content management system (CMS) for Silverstripe websites. It includes features such as a WYSIWYG editor for creating and editing content.
This vulnerability allows a malicious actor to inject and execute malicious JavaScript code, potentially leading to attacks such as cross-site scripting (XSS). This can result in the theft of sensitive information or unauthorized actions on behalf of the user.
Versions 1.0.3 to 1.0.4 and 1.1.0 to 1.1.1 of the Silverstripe admin package are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to the latest version of the Silverstripe admin package. For versions 1.0.3 to 1.0.4, upgrade to version 1.0.4. For versions 1.1.0 to 1.1.1, upgrade to version 1.1.1.
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest version of the Silverstripe admin package.
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/admin.
