Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to
    inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the
    Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web
    script or HTML via (2) the Search parameter to forums/search (aka the search script). (CVE-2010-1593)

The SilverStripe CMS install hosted on the remote web server includes a version of the Forums module that is affected by a cross-site scripting vulnerability.  User input to the 'Search' parameter is not sanitized before being used to generate dynamic HTML.

An attacker can exploit this flaw to execute arbitrary script code in a user's browser.

The remote web server is hosting SilverStripe CMS. The installed version of SilverStripe is earlier than 2.3.5.  Such versions are potentially affected by a persistent cross-site scripting vulnerability becase the application fails to properly sanitize user-supplied input to the 'CommenterURL' parameter in the comment posting mechanism.  An attacker could exploit this flaw in order to execute arbitrary script code in a user's browser.

ID	Name	Product	Family	Severity
437306	SCA: security update for silverstripe/cms, silverstripe/framework (GHSA-wg4m-vvp6-2hc5)	Tenable Cloud Security	SCA Checks	medium
437306	SCA: security update for silverstripe/cms, silverstripe/framework (GHSA-wg4m-vvp6-2hc5)	Tenable Self-Hosted Container Security	SCA Checks	medium
44332	SilverStripe Forums Module 'Search' Parameter XSS	Nessus	CGI abuses : XSS	medium
5329	SilverStripe < 2.3.5 Cross-site Scripting Vulnerability	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2010-1593

low

Tenable Plugins

medium

medium

medium

high