CVE-2022-38148
Blind SQL Injection via GridFieldSortableHeader
CVE-2022-38148 is a high vulnerability (CVSS 8.8) in Silverstripe Framework, published November 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 57th percentile. Fixed in silverstripe/framework 4.10.11.
- Severity
- 8.8 HighCVSS 3.1, NVD
- Exploit chance
- 0.80%EPSS, 57th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.10.11silverstripe/framework +3 more
Description
Silverstripe silverstripe/framework through 4.11 allows SQL Injection.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | 4.0.0 up to 4.10.11 | 4.10.11 |
silverstripe/frameworkPackagist | 4.11.0 up to 4.11.14 | 4.11.14 |
silverstripe/frameworkPackagist | 4.0.0 up to 4.10.11, plus listed versions 4.0.14.0.1-rc14.0.24.0.34.0.4 Show 45 moreShow less4.0.54.0.64.0.74.1.04.1.0-rc14.1.0-rc24.1.14.1.24.1.34.1.44.1.54.10.04.10.0-beta14.10.0-rc14.10.14.10.104.10.24.10.34.10.44.10.54.10.64.10.74.10.84.10.94.2.04.2.0-beta14.2.14.2.24.2.34.2.44.2.54.3.04.3.0-rc14.3.14.3.24.3.34.3.44.3.54.4.04.4.0-rc14.4.14.4.24.4.34.4.44.4.5 | 4.10.11 |
silverstripe/frameworkPackagist | 4.11.0 up to 4.11.14, plus listed versions 4.11.14.11.104.11.114.11.124.11.13 Show 8 moreShow less4.11.24.11.34.11.44.11.54.11.64.11.74.11.84.11.9 | 4.11.14 |
What each source reports
NVD Score used
Silverstripe silverstripe/framework through 4.11 allows SQL Injection.
- Record
CVE-2022-38148- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List
Silverstripe silverstripe/framework through 4.11 allows SQL Injection.
- Record
CVE-2022-38148- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2022-7430
Silverstripe silverstripe/framework through 4.11 allows SQL Injection.
- Record
EUVD-2022-7430- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rr8h-f97q-8p9c
Blind SQL Injection via GridFieldSortableHeader
Gridfield state is vulnerable to SQL injections. The vast majority of Gridfields in Silverstripe CMS are affected by this vulnerability.
An attacker with CMS access could execute an arbitrary SQL statement by adding an SQL payload in some parts of the GridField state.
- Record
GHSA-rr8h-f97q-8p9c- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
Silverstripe silverstripe/framework through 4.11 allows SQL Injection.
- Record
CVE-2022-38148- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-rr8h-f97q-8p9c
Blind SQL Injection via GridFieldSortableHeader
Gridfield state is vulnerable to SQL injections. The vast majority of Gridfields in Silverstripe CMS are affected by this vulnerability.
An attacker with CMS access could execute an arbitrary SQL statement by adding an SQL payload in some parts of the GridField state.
- Record
GHSA-rr8h-f97q-8p9c- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
silverstripe.org/download/security-releases
forum.silverstripe.org/c/releases
nvd.nist.gov/vuln/detail/CVE-2022-38148
github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-38148.yaml
Left out here: 34 versions. The JSON record has them.