Every CVESearch/Get API key

GHSA-r85g-7jpv-8xrx

silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL

6.1 MediumFix available

In follow up to SS-2016-001 there is yet a minor unresolved fix to incorrectly encoded URL.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

What each source reports

GitHub Advisories Score used6.1

silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL

In follow up to SS-2016-001 there is yet a minor unresolved fix to incorrectly encoded URL.

Record
GHSA-r85g-7jpv-8xrx
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV6.1

silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL

In follow up to SS-2016-001 there is yet a minor unresolved fix to incorrectly encoded URL.

Record
GHSA-r85g-7jpv-8xrx
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
silverstripe/framework
Packagist
3.1.0-rc1 up to 3.1.21
3.1.21
silverstripe/framework
Packagist
3.2.0-rc1 up to 3.2.6
3.2.6
silverstripe/framework
Packagist
3.3.0-rc1 up to 3.3.4
3.3.4
silverstripe/framework
Packagist
3.4.0-rc1 up to 3.4.2
3.4.2
silverstripe/framework
Packagist
3.1.0-rc1 up to 3.1.21, plus listed versions
3.1.03.1.0-rc23.1.0-rc33.1.13.1.10
Show 41 moreShow less
3.1.10-rc13.1.10-rc23.1.113.1.11-rc13.1.123.1.133.1.13-rc13.1.143.1.14-rc13.1.153.1.163.1.16-rc13.1.173.1.17-rc13.1.17-rc23.1.183.1.18-rc13.1.18-rc23.1.193.1.19-rc13.1.23.1.2-rc13.1.203.1.20-rc13.1.20-rc23.1.33.1.3-rc13.1.3-rc23.1.43.1.4-rc13.1.53.1.5-rc13.1.63.1.6-rc13.1.6-rc23.1.6-rc33.1.73.1.7-rc13.1.83.1.93.1.9-rc1
3.1.21
silverstripe/framework
Packagist
3.2.0-rc1 up to 3.2.6, plus listed versions
3.2.03.2.0-rc23.2.13.2.1-rc13.2.1-rc2
Show 11 moreShow less
3.2.23.2.2-rc13.2.2-rc23.2.33.2.3-rc13.2.3-rc23.2.43.2.4-rc13.2.53.2.5-rc13.2.5-rc2
3.2.6
silverstripe/framework
Packagist
3.3.0-rc1 up to 3.3.4, plus listed versions
3.3.03.3.0-rc23.3.0-rc33.3.13.3.1-rc1
Show 6 moreShow less
3.3.1-rc23.3.23.3.2-rc13.3.33.3.3-rc13.3.3-rc2
3.3.4
silverstripe/framework
Packagist
3.4.0-rc1 up to 3.4.2, plus listed versions
3.4.03.4.13.4.1-rc13.4.1-rc2
3.4.2

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-r85g-7jpv-8xrx is a medium vulnerability (CVSS 6.1) in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.1.21.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open