CVE-2022-38724: XSS
First published: Sun Nov 21 2021(Updated: )
A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used to inject a JavaScript payload on the front end of the site. The shortcode providers that ship with Silverstripe CMS have been reviewed and attribute whitelists have been implemented where appropriate to negate this risk.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/silverstripe/framework | >=4.0.0<4.11.13 | |
| composer/silverstripe/assets | >=1.0.0<1.11.1 | |
| composer/silverstripe/framework | >=4.0.0<4.11.13 | 4.11.13 |
| composer/silverstripe/assets | >=1.0.0<1.11.1 | 1.11.1 |
| Silverstripe Asset Admin | <=1.11.0 | |
| Silverstripe Assets | >=1.0.0<=1.11.0 | |
| Silverstripe Framework | >=4.0.0<=4.11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.silverstripe.org/download/security-releases/cve-2022-38724
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2022-38724.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-38724.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2022-38724
- https://forum.silverstripe.org/c/releases
- https://www.silverstripe.org/blog/tag/release
- https://www.silverstripe.org/download/security-releases/
- https://github.com/advisories/GHSA-9cx2-hj6m-fv58 (Advisory)
- https://www.silverstripe.org/download/security-releases/CVE-2022-38724
Frequently Asked Questions
What is CVE-2022-38724?
CVE-2022-38724 is a vulnerability that allows a malicious content author to inject a JavaScript payload on the front end of a site using arbitrary attributes in HTML editor shortcodes.
How severe is CVE-2022-38724?
CVE-2022-38724 has a severity rating of 5.4 out of 10, which is considered medium.
What software is affected by CVE-2022-38724?
CVE-2022-38724 affects Silverstripe CMS framework versions 4.0.0 through 4.11.13 and Silverstripe Assets versions 1.0.0 through 1.11.1.
How can I fix CVE-2022-38724?
To fix CVE-2022-38724, update your Silverstripe CMS framework and Silverstripe Assets to versions 4.11.13 and 1.11.1 respectively. Refer to the provided references for more information.
What is the CWE category of CVE-2022-38724?
CVE-2022-38724 belongs to CWE category 79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
- collector/friends-of-php
- collector/github-advisory-latest
- alias/GHSA-9cx2-hj6m-fv58
- alias/CVE-2022-38724
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/severity
- agent/description
- agent/tags
- agent/event
- agent/trending
- package-manager/composer
- vendor/silverstripe
- canonical/silverstripe asset admin
- version/silverstripe asset admin/1.11.0
- canonical/silverstripe assets
- version/silverstripe assets/1.0.0
- version/silverstripe assets/1.11.0
- canonical/silverstripe framework
- version/silverstripe framework/4.0.0
- version/silverstripe framework/4.11.0