GHSA-pp7q-6j3f-74vj
silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage
RedirectorPage will allow users to specify a non-url malicious script as the redirection path without validation. Users which follow this url may allow this script to execute within their browser.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage
RedirectorPage will allow users to specify a non-url malicious script as the redirection path without validation. Users which follow this url may allow this script to execute within their browser.
- Record
GHSA-pp7q-6j3f-74vj- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage
RedirectorPage will allow users to specify a non-url malicious script as the redirection path without validation. Users which follow this url may allow this script to execute within their browser.
- Record
GHSA-pp7q-6j3f-74vj- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | 3.4.0-rc1 up to 3.4.6 | 3.4.6 |
silverstripe/frameworkPackagist | 3.5.0-rc1 up to 3.5.4 | 3.5.4 |
silverstripe/frameworkPackagist | 3.4.0-rc1 up to 3.4.6, plus listed versions 3.4.03.4.13.4.1-rc13.4.1-rc23.4.2 Show 8 moreShow less3.4.33.4.3-rc13.4.43.4.4-rc13.4.53.4.5-rc13.4.6-rc13.4.6-rc2 | 3.4.6 |
silverstripe/frameworkPackagist | 3.5.0-rc1 up to 3.5.4, plus listed versions 3.5.03.5.0-rc23.5.0-rc33.5.13.5.1-rc1 Show 6 moreShow less3.5.1-rc23.5.23.5.2-rc13.5.33.5.3-rc13.5.4-rc1 | 3.5.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-pp7q-6j3f-74vj is a medium vulnerability (CVSS 6.1) in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.4.6.