TI-2024-38782 Aliases GHSA-p2v5-xcqm-4fv6

silverstripe/taxonomy SQL Injection vulnerability

LOW 38CWE-89Published 2024-05-28 · Updated 2024-05-28

Key facts

Attack vector: —
Privileges required: —
User interaction: —
Attack complexity: —
Impact type: SQL injection
Confidentiality · integrity · availability: —
Fix status: Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-89.

Summary

There is a vulnerability in silverstripe/taxonomy module that allows SQL injection. This affected controller (`TaxonomyDirectoryController`) is disabled by default and must be enabled by a developer for the exploit to be possible.

Why it matters now

Fix Fixed silverstripe/taxonomy (Packagist): 1.3.1, 2.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	silverstripe/taxonomy (Packagist)	1.3.0 to before 1.3.1	1.3.1	Patch available	GHSA-p2v5-xcqm-4fv6
—	silverstripe/taxonomy (Packagist)	2.0.0 to before 2.0.1	2.0.1	Patch available	GHSA-p2v5-xcqm-4fv6

silverstripe/taxonomy (Packagist) Vendor— Affected 1.3.0 to before 1.3.1 Fixed in 1.3.1 Patch available GHSA-p2v5-xcqm-4fv6
silverstripe/taxonomy (Packagist) Vendor— Affected 2.0.0 to before 2.0.1 Fixed in 2.0.1 Patch available GHSA-p2v5-xcqm-4fv6

Remediation

Fix · GHSA-p2v5-xcqm-4fv6 silverstripe/taxonomy (Packagist) Fixed in 1.3.1 Advisory →
Fix · GHSA-p2v5-xcqm-4fv6 silverstripe/taxonomy (Packagist) Fixed in 2.0.1 Advisory →

Timeline

2026-10-03 Threatist record created from GHSA-p2v5-xcqm-4fv6

References

Other 5

Sources

GHSA-p2v5-xcqm-4fv6 · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences