GHSA-c4c3-j73v-634r
silverstripe/framework has Cross-site Scripting vulnerability in page history comparison
Authenticated user with page edit permission can craft HTML, which when rendered in a page history comparison can execute client scripts.
What each source reports
GitHub AdvisoriesNo score
silverstripe/framework has Cross-site Scripting vulnerability in page history comparison
Authenticated user with page edit permission can craft HTML, which when rendered in a page history comparison can execute client scripts.
- Record
GHSA-c4c3-j73v-634r- Updated
- 2026-11-02
OSVNo score
silverstripe/framework has Cross-site Scripting vulnerability in page history comparison
Authenticated user with page edit permission can craft HTML, which when rendered in a page history comparison can execute client scripts.
- Record
GHSA-c4c3-j73v-634r- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | 3.4.0-rc1 up to 3.4.6 | 3.4.6 |
silverstripe/frameworkPackagist | 3.5.0-rc1 up to 3.5.4 | 3.5.4 |
silverstripe/frameworkPackagist | 3.4.0-rc1 up to 3.4.6, plus listed versions 3.4.03.4.13.4.1-rc13.4.1-rc23.4.2 Show 8 moreShow less3.4.33.4.3-rc13.4.43.4.4-rc13.4.53.4.5-rc13.4.6-rc13.4.6-rc2 | 3.4.6 |
silverstripe/frameworkPackagist | 3.5.0-rc1 up to 3.5.4, plus listed versions 3.5.03.5.0-rc23.5.0-rc33.5.13.5.1-rc1 Show 6 moreShow less3.5.1-rc23.5.23.5.2-rc13.5.33.5.3-rc13.5.4-rc1 | 3.5.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-c4c3-j73v-634r is a vulnerability with no CVSS score yet in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.4.6.
References
github.com/silverstripe/silverstripe-framework/commit/2b72c0f73b668ddf7c059319da915a6c08652278
silverstripe.org/download/security-releases/ss-2017-004