GHSA-jqp8-v74p-g8px
Silverstripe XSS in Director::force_redirect()
GHSA-jqp8-v74p-g8px is a medium vulnerability (CVSS 6.1) in silverstripe/framework, published May 23, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.1.12.
- Severity
- 6.1 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.1.12silverstripe/framework +1 more
Description
A low level XSS vulnerability has been found in the Framework affecting http redirection via the Director::force_redirect method.
Attempts to redirect to a url may generate HTML which is not safely escaped, and may pose a risk of XSS in some environments.
This vulnerability is marked low as it is difficult to exploit, as any injected HTML will only be returned from the server if the Location HTTP header is also sent, meaning that any user browsing the site would not be exposed to the body of the response before their browser redirects them.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | 3.1.0 up to 3.1.12 | 3.1.12 |
silverstripe/frameworkPackagist | 3.1.0 up to 3.1.12, plus listed versions 3.1.13.1.103.1.10-rc13.1.10-rc23.1.11 Show 19 moreShow less3.1.11-rc13.1.23.1.2-rc13.1.33.1.3-rc13.1.3-rc23.1.43.1.4-rc13.1.53.1.5-rc13.1.63.1.6-rc13.1.6-rc23.1.6-rc33.1.73.1.7-rc13.1.83.1.93.1.9-rc1 | 3.1.12 |
What each source reports
GitHub Advisories Score used
Silverstripe XSS in Director::force_redirect()
A low level XSS vulnerability has been found in the Framework affecting http redirection via the Director::force_redirect method.
Attempts to redirect to a url may generate HTML which is not safely escaped, and may pose a risk of XSS in some environments.
This vulnerability is marked low as it is difficult to exploit, as any injected HTML will only be returned from the server if the Location HTTP header is also sent, meaning that any user browsing the site would not be exposed to the body of the response before their browser redirects them.
- Record
GHSA-jqp8-v74p-g8px- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Silverstripe XSS in Director::force_redirect()
A low level XSS vulnerability has been found in the Framework affecting http redirection via the Director::force_redirect method.
Attempts to redirect to a url may generate HTML which is not safely escaped, and may pose a risk of XSS in some environments.
This vulnerability is marked low as it is difficult to exploit, as any injected HTML will only be returned from the server if the Location HTTP header is also sent, meaning that any user browsing the site would not be exposed to the body of the response before their browser redirects them.
- Record
GHSA-jqp8-v74p-g8px- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/silverstripe/silverstripe-framework/commit/ee9bddb808df6d27db4d56bb5d522dcfe6788715
silverstripe.org/software/download/security-releases/ss-2015-010-xss-in-directorforce-redirect