CVE-2022-38145

Stored XSS in Compare Mode

5.4 MediumFix available

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.66%Down 0.5 points since Nov 23, 2022

What each source reports

NVD Score used 5.4

Record: CVE-2022-38145
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List 5.4

Record: CVE-2022-38145
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2022-7251 5.4

Record: EUVD-2022-7251
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-66jf-xm2m-7m8r 5.4

Stored XSS in Compare Mode

A malicious content author could add a Javascript payload to a page's meta description and get it executed in the versioned history compare view.

This vulnerability requires access to the CMS to be deployed. The attacker must then convince a privileged user to access the version history for that page.

Record: GHSA-66jf-xm2m-7m8r
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 5.4

Record: CVE-2022-38145
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-66jf-xm2m-7m8r 5.4

Stored XSS in Compare Mode

A malicious content author could add a Javascript payload to a page's meta description and get it executed in the versioned history compare view.

This vulnerability requires access to the CMS to be deployed. The attacker must then convince a privileged user to access the version history for that page.

Record: GHSA-66jf-xm2m-7m8r
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

silverstripe framework

Affected packages

Affected packages
Package	Affected	Fixed
`silverstripe/versioned-admin` Packagist	1.0.0 up to 1.11.1	1.11.1
`silverstripe/versioned-admin` Packagist	1.0.0 up to 1.11.1, plus listed versions 1.1.01.1.0-rc11.1.11.1.21.1.3 Show 40 moreShow less 1.1.41.1.51.10.01.10.0-beta11.10.0-rc11.10.11.11.01.11.0-beta11.11.0-rc11.2.01.2.0-rc11.2.11.2.21.2.31.2.41.3.01.3.0-alpha11.3.0-rc11.3.0-rc21.3.11.6.01.6.0-beta11.6.0-rc11.6.11.7.01.7.0-beta11.7.0-rc11.7.11.7.21.7.31.8.01.8.0-beta11.8.0-beta21.8.0-rc11.8.11.9.01.9.0-alpha11.9.0-beta11.9.0-rc11.9.1	1.11.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-38145 is a medium vulnerability (CVSS 5.4) in Silverstripe Framework, published November 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in silverstripe/versioned-admin 1.11.1.