Description
In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted login form URLs.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | silverstripe/cms | <= 4.5.0 | — | GHSA-2pw2-qpcp-m47x |
| Packagist | silverstripe/framework | >= 3.0.0, < 3.7.5 | 3.7.5 | GHSA-2pw2-qpcp-m47x |