silverstripeCMS Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2011-4958 - Vulnerability Database

silverstripeCMS Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2011-4958

Medium

Reference: CVE-2011-4958

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2011-4958

Title: silverstripeCMS Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability

Overview:

Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders as demonstrated by a request to (1) admin/reports/ (2) admin/comments/ (3) admin/ (4) admin/show/ (5) admin/assets/ and (6) admin/security/.