XSS in Silverstripe
CVE-2019-19325
SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.007 (48.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Silverstripe
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-19325?
- CVE-2019-19325 is a medium-severity vulnerability in Silverstripe, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-02-17.
- How severe is CVE-2019-19325?
- Medium severity. CVSS v3 base score is 6.1 out of 10.