Server side cross-site scripting In silverstripe/framework
Description
Silverstripe XSS in TreeDropdownField and TreeMultiSelectField A cross-site scripting vulnerability has been discovered in the TreeDropdownField and TreeMultiSelectField.
This vulnerability can only be exploited if a user with CMS access has posted malicious or unescaped HTML into any of the dataobjects used as a data source for either of these fields.
This has been resolved by ensuring that all dataobjects used as a data source have their content safely encoded.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 packagist | 3.1.10 |
Aliases
1.
References
1. 2. 3.