CVE-2022-25238
Stored XSS via HTML fields in SilverStripe Framework
Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
- Record
CVE-2022-25238- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
- Record
CVE-2022-25238- Updated
- 2026-11-02
EUVDEUVD-2022-6088 No score
Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
- Record
EUVD-2022-6088- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jx34-gqqq-r6gm
Stored XSS via HTML fields in SilverStripe Framework
SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
- Record
GHSA-jx34-gqqq-r6gm- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-jx34-gqqq-r6gm
Stored XSS via HTML fields in SilverStripe Framework
SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
- Record
GHSA-jx34-gqqq-r6gm- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code.
- Record
CVE-2022-25238- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist |
4.0.0 up to 4.10.9 | 4.10.9 |
silverstripe/frameworkPackagist |
4.0.0 up to 4.10.9, plus listed versions 4.0.14.0.1-rc14.0.24.0.34.0.4 Show 45 moreShow less4.0.54.0.64.0.74.1.04.1.0-rc14.1.0-rc24.1.14.1.24.1.34.1.44.1.54.10.04.10.0-beta14.10.0-rc14.10.14.10.24.10.34.10.44.10.54.10.64.10.74.10.84.2.04.2.0-beta14.2.14.2.24.2.34.2.44.2.54.3.04.3.0-rc14.3.14.3.24.3.34.3.44.3.54.4.04.4.0-rc14.4.14.4.24.4.34.4.44.4.54.4.64.4.7 |
4.10.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-25238 is a medium vulnerability (CVSS 5.4) in Silverstripe Framework, published June 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in silverstripe/framework 4.10.9.
References
silverstripe.org/download/security-releases
forum.silverstripe.org/c/releases
docs.silverstripe.org/en/4/changelogs/4.10.1
nvd.nist.gov/vuln/detail/CVE-2022-25238
github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-25238.yaml
Left out here: 32 versions. The JSON record has them.