Every CVESearch/Get API key

GHSA-mpqj-f4v3-334h

Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter

6.1 MediumFix available

GHSA-mpqj-f4v3-334h is a medium vulnerability (CVSS 6.1) in silverstripe/framework, published May 23, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.3.3.

What does this mean?
Severity
6.1 MediumCVSS 3.1, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
3.3.3silverstripe/framework +3 more

Description

A cross-site scripting vulnerability in VersionedRequestFilter has been found.

If an incoming user request should not be able to access the requested stage, an error message is created for display on the CMS login page that they are redirected to. In this error message, the URL of the requested page is interpolated into the error message without being escaped; hence, arbitrary HTML can be injected into the CMS login page.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Affected packages

Affected packages
PackageAffectedFixed
silverstripe/framework
Packagist
3.3.2 up to 3.3.3
3.3.3
silverstripe/framework
Packagist
3.4.0 up to 3.4.1
3.4.1
silverstripe/framework
Packagist
3.3.2 up to 3.3.3, plus listed versions
3.3.3-rc13.3.3-rc2
3.3.3
silverstripe/framework
Packagist
3.4.0 up to 3.4.1, plus listed versions
3.4.1-rc13.4.1-rc2
3.4.1

What each source reports

GitHub Advisories Score used6.1

Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter

A cross-site scripting vulnerability in VersionedRequestFilter has been found.

If an incoming user request should not be able to access the requested stage, an error message is created for display on the CMS login page that they are redirected to. In this error message, the URL of the requested page is interpolated into the error message without being escaped; hence, arbitrary HTML can be injected into the CMS login page.

Record
GHSA-mpqj-f4v3-334h
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV6.1

Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter

A cross-site scripting vulnerability in VersionedRequestFilter has been found.

If an incoming user request should not be able to access the requested stage, an error message is created for display on the CMS login page that they are redirected to. In this error message, the URL of the requested page is interpolated into the error message without being escaped; hence, arbitrary HTML can be injected into the CMS login page.

Record
GHSA-mpqj-f4v3-334h
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open