logo

Database

Server side cross-site scripting In silverstripe/cms

Description

Silverstripe CMS XSS Vulnerability Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.0 before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2015-86062. NVD-2015-86063. OSV-2015-86064. GCVE-2015-8606

References

1. https://cybersecurityworks.com/zerodays/cve-2015-8606-silverstripe.html2. http://seclists.org/fulldisclosure/2015/Dec/553. http://www.openwall.com/lists/oss-security/2015/12/17/14. http://www.openwall.com/lists/oss-security/2015/12/17/115. http://www.openwall.com/lists/oss-security/2015/12/18/56. http://www.silverstripe.org/download/security-releases/ss-2015-026

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.