Read the docs
TI-2024-38741 Aliases GHSA-j982-5jv7-v43r

Silverstripe Form field validation message XSS vulnerability

Priority LOW 38CWE-79Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Cross-site scripting
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.

Summary

A high level XSS risk has been identified in the encoding of validation messages in certain FormField classes. Certain fields such as the NumericField and DropdownField have been identified, but any form field which presents any invalid content as a part of its validation response will be at risk.

Why it matters now

Fix Fixed silverstripe/framework (Packagist): 3.1.16, 3.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—silverstripe/framework (Packagist)3.0.0 to before 3.1.163.1.16Patch availableGHSA-j982-5jv7-v43r
—silverstripe/framework (Packagist)3.2.0 to before 3.2.13.2.1Patch availableGHSA-j982-5jv7-v43r
  • silverstripe/framework (Packagist) Vendor— Affected 3.0.0 to before 3.1.16 Fixed in 3.1.16 Patch available GHSA-j982-5jv7-v43r
  • silverstripe/framework (Packagist) Vendor— Affected 3.2.0 to before 3.2.1 Fixed in 3.2.1 Patch available GHSA-j982-5jv7-v43r

Remediation

  • Fix · GHSA-j982-5jv7-v43r silverstripe/framework (Packagist) Fixed in 3.1.16 Advisory →
  • Fix · GHSA-j982-5jv7-v43r silverstripe/framework (Packagist) Fixed in 3.2.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-j982-5jv7-v43r

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences