Publish GHSA-jqp8-v74p-g8px

2026-05-22 18:04:22 -07:00 · 2024-05-23 16:49:39 +00:00
parent 77623f88d3
commit 6f67005a3f
1 changed files with 65 additions and 0 deletions
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jqp8-v74p-g8px",
+  "modified": "2024-05-23T16:48:11Z",
+  "published": "2024-05-23T16:48:11Z",
+  "aliases": [
+
+  ],
+  "summary": "Silverstripe XSS in Director::force_redirect()",
+  "details": "A low level XSS vulnerability has been found in the Framework affecting http redirection via the Director::force_redirect method.\n\nAttempts to redirect to a url may generate HTML which is not safely escaped, and may pose a risk of XSS in some environments.\n\nThis vulnerability is marked low as it is difficult to exploit, as any injected HTML will only be returned from the server if the Location HTTP header is also sent, meaning that any user browsing the site would not be exposed to the body of the response before their browser redirects them.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "silverstripe/framework"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.1.0"
+            },
+            {
+              "fixed": "3.1.12"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/silverstripe/silverstripe-framework/commit/ee9bddb808df6d27db4d56bb5d522dcfe6788715"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-010-1.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/silverstripe/silverstripe-framework"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.silverstripe.org/software/download/security-releases/ss-2015-010-xss-in-directorforce-redirect"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-23T16:48:11Z",
+    "nvd_published_at": null
+  }
+}