{"id":"GHSA-gvc8-xjfp-6569","summary":"Silverstripe CMS XSS Vulnerability","details":"Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.0 before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to `admin/security/EditForm/field/Members/item/new/ItemEditForm`.","aliases":["CVE-2015-8606"],"modified":"2024-02-16T08:18:02.222081Z","published":"2022-05-13T01:13:58Z","database_specific":{"nvd_published_at":"2016-04-13T15:59:00Z","cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2023-08-01T19:50:39Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8606"},{"type":"WEB","url":"https://cybersecurityworks.com/zerodays/cve-2015-8606-silverstripe.html"},{"type":"PACKAGE","url":"https://github.com/silverstripe/silverstripe-cms"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2015/Dec/55"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/12/17/1"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/12/17/11"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/12/18/5"},{"type":"WEB","url":"http://www.silverstripe.org/download/security-releases/ss-2015-026"}],"affected":[{"package":{"name":"silverstripe/cms","ecosystem":"Packagist","purl":"pkg:composer/silverstripe/cms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.16"}]}],"versions":["2.4.10","2.4.11","2.4.12","2.4.13","2.4.9","2.5.0","3.0.10","3.0.10-rc1","3.0.11","3.0.11-rc1","3.0.12","3.0.13","3.0.14","3.0.2.1","3.0.3","3.0.3-rc1","3.0.3-rc2","3.0.4","3.0.5","3.0.6","3.0.6-rc1","3.0.6-rc2","3.0.7","3.0.7-rc1","3.0.8","3.0.9","3.0.9-rc1","3.1.0","3.1.0-beta1","3.1.0-beta2","3.1.0-beta3","3.1.0-rc1","3.1.0-rc2","3.1.0-rc3","3.1.1","3.1.10","3.1.10-rc1","3.1.10-rc2","3.1.11","3.1.11-rc1","3.1.12","3.1.13","3.1.13-rc1","3.1.14","3.1.14-rc1","3.1.15","3.1.16-rc1","3.1.2","3.1.2-rc1","3.1.3","3.1.3-rc1","3.1.3-rc2","3.1.4","3.1.4-rc1","3.1.5","3.1.5-rc1","3.1.6","3.1.6-rc1","3.1.6-rc2","3.1.6-rc3","3.1.7","3.1.7-rc1","3.1.8","3.1.9","3.1.9-rc1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gvc8-xjfp-6569/GHSA-gvc8-xjfp-6569.json","last_known_affected_version_range":"\u003c= 3.1.15"}},{"package":{"name":"silverstripe/cms","ecosystem":"Packagist","purl":"pkg:composer/silverstripe/cms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.1"}]}],"versions":["3.2.0","3.2.1-rc1","3.2.1-rc2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gvc8-xjfp-6569/GHSA-gvc8-xjfp-6569.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}