Description
Cross-site scripting (XSS) vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter. NOTE: some of these details are obtained from third party information.
References
- http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7
- https://github.com/silverstripe/sapphire/commit/475e077
- 78677 vdb-entry
- 51761 vdb-entry
- 47812 third-party-advisory
- [oss-security] 20120430 Re: CVE-request: SilverStripe before 2.4.4 mailing-list
- https://github.com/silverstripe/sapphire/commit/5fe7091
- http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13
- silverstripe-editform-xss(72820) vdb-entry
- http://packetstormsecurity.org/files/view/109210/silverstripecmspage-xss.txt
- https://github.com/silverstripe/sapphire/commit/252e187