Read the docs
TI-2024-38759 Aliases GHSA-hhvj-mcrx-3vcf

silverstripe/framework has Cross-site Scripting vulnerability in page name

Priority LOW 38CWE-79Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Cross-site scripting
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.

Summary

silverstripe/framework is vulnerable to XSS in Page name where the payload `"><svg/onload=alert(/xss/)>` will trigger an XSS alert.

Why it matters now

Fix Fixed silverstripe/framework (Packagist): 3.4.4, 3.5.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—silverstripe/framework (Packagist)3.4.0-rc1 to before 3.4.43.4.4Patch availableGHSA-hhvj-mcrx-3vcf
—silverstripe/framework (Packagist)3.5.0-rc1 to before 3.5.23.5.2Patch availableGHSA-hhvj-mcrx-3vcf
  • silverstripe/framework (Packagist) Vendor— Affected 3.4.0-rc1 to before 3.4.4 Fixed in 3.4.4 Patch available GHSA-hhvj-mcrx-3vcf
  • silverstripe/framework (Packagist) Vendor— Affected 3.5.0-rc1 to before 3.5.2 Fixed in 3.5.2 Patch available GHSA-hhvj-mcrx-3vcf

Remediation

  • Fix · GHSA-hhvj-mcrx-3vcf silverstripe/framework (Packagist) Fixed in 3.4.4 Advisory →
  • Fix · GHSA-hhvj-mcrx-3vcf silverstripe/framework (Packagist) Fixed in 3.5.2 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-hhvj-mcrx-3vcf

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences