Skip to content
Fencer Intel
medium 5.4

GHSA-4q66-g4mm-8rg5 json

Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE

published 3y ago modified last yr.

cvss
5.4
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting `silverstripe/admin`.

Only Silverstripe CMS 4 is affected by this issue. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in `silverstripe/admin`.

Silverstripe CMS 5 is not affected by those vulnerabilities because it uses TinyMCE 6.

You can find more information about the underlying vulnerabilities in those GitHub security advisories:

- [GHSA-5h9g-x5rv-25wg Cross-site scripting vulnerability in TinyMCE](https://github.com/advisories/GHSA-5h9g-x5rv-25wg) - [GHSA-w7jx-j77m-wp65 Cross-site scripting vulnerability in TinyMCE](https://github.com/advisories/GHSA-w7jx-j77m-wp65)

Patch / fix

  • packagist silverstripe/admin 1.13.6

Is GHSA-4q66-g4mm-8rg5 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
packagist silverstripe/admin
<1.13.6
1.13.6

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.