{"id":"GHSA-p2v5-xcqm-4fv6","summary":"silverstripe/taxonomy SQL Injection vulnerability","details":"There is a vulnerability in silverstripe/taxonomy module that allows SQL injection. This affected controller (`TaxonomyDirectoryController`) is disabled by default and must be enabled by a developer for the exploit to be possible.\n\n","modified":"2024-12-03T06:09:12.665528Z","published":"2024-05-28T17:29:03Z","database_specific":{"github_reviewed_at":"2024-05-28T17:29:03Z","nvd_published_at":null,"cwe_ids":["CWE-89"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/silverstripe/silverstripe-taxonomy/commit/01a5d9e04b993df507058aa53e6e18efc5ca405b"},{"type":"WEB","url":"https://github.com/silverstripe/silverstripe-taxonomy/commit/d037941e931490c33af5029c676447ed38896ee8"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/taxonomy/SS-2018-011-1.yaml"},{"type":"PACKAGE","url":"https://github.com/silverstripe/silverstripe-taxonomy"},{"type":"WEB","url":"https://www.silverstripe.org/download/security-releases/ss-2018-011"}],"affected":[{"package":{"name":"silverstripe/taxonomy","ecosystem":"Packagist","purl":"pkg:composer/silverstripe/taxonomy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}],"versions":["1.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-p2v5-xcqm-4fv6/GHSA-p2v5-xcqm-4fv6.json"}},{"package":{"name":"silverstripe/taxonomy","ecosystem":"Packagist","purl":"pkg:composer/silverstripe/taxonomy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-p2v5-xcqm-4fv6/GHSA-p2v5-xcqm-4fv6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}