Fluid Attacks Database

Description

Silverstripe CMS XSS Vulnerability There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
packagist	silverstripe/cms	>=0 <3.4.4 \|\| >=3.5.0 <3.5.2	3.4.4, 3.5.2
packagist	silverstripe/framework	>=0 <=3.4.3 \|\| >=3.5.0 <=3.5.1	3.4.4, 3.5.2

Aliases

1. CVE-2017-51972. NVD-2017-51973. OSV-2017-51974. GCVE-2017-5197

References

1. https://web.archive.org/web/20210123234141/http://www.securityfocus.com/bid/965722. https://www.silverstripe.org/download/security-releases3. http://www.securityfocus.com/bid/965724. https://www.silverstripe.org/download/security-releases/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.