Description
Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
silverstripe silverstripe-cms
< 6.2.1affected
References
- https://github.com/silverstripe/silverstripe-cms/security/advisories/GHSA-w3cp-g2pf-65wh ↗
- https://github.com/silverstripe/silverstripe-cms/pull/3175 ↗
- https://github.com/silverstripe/silverstripe-cms/commit/62f9912baa18c80304f3fa8b6eca71bb5dc2d21e ↗
- https://github.com/silverstripe/silverstripe-cms/releases/tag/6.2.1 ↗