{"id":"GHSA-p2v5-xcqm-4fv6","aliases":[],"status":"published","title":"silverstripe/taxonomy SQL Injection vulnerability","description":"There is a vulnerability in silverstripe/taxonomy module that allows SQL injection. This affected controller (`TaxonomyDirectoryController`) is disabled by default and must be enabled by a developer for the exploit to be possible.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2024-05-28T17:29:03Z","modified":"2024-12-03T06:09:12Z","fixes":[{"ecosystem":"Packagist","package":"silverstripe/taxonomy","fixed_in":["1.3.1","2.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"silverstripe/taxonomy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"silverstripe/taxonomy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"silverstripe/taxonomy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.1"}]}],"versions":["1.3.0"]},{"source":"osv","ecosystem":"Packagist","package":"silverstripe/taxonomy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"]}],"references":[{"url":"https://github.com/silverstripe/silverstripe-taxonomy/commit/01a5d9e04b993df507058aa53e6e18efc5ca405b","tags":["web"]},{"url":"https://github.com/silverstripe/silverstripe-taxonomy/commit/d037941e931490c33af5029c676447ed38896ee8","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/taxonomy/SS-2018-011-1.yaml","tags":["web"]},{"url":"https://www.silverstripe.org/download/security-releases/ss-2018-011","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p2v5-xcqm-4fv6"},{"url":"https://github.com/silverstripe/silverstripe-taxonomy","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-p2v5-xcqm-4fv6","title":"silverstripe/taxonomy SQL Injection vulnerability","description":"There is a vulnerability in silverstripe/taxonomy module that allows SQL injection. This affected controller (`TaxonomyDirectoryController`) is disabled by default and must be enabled by a developer for the exploit to be possible.\n\n","status":"published","published":"2024-05-28T17:29:03Z","modified":"2024-05-28T17:29:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:52.2286Z"}],"osv":[{"id":"GHSA-p2v5-xcqm-4fv6","title":"silverstripe/taxonomy SQL Injection vulnerability","description":"There is a vulnerability in silverstripe/taxonomy module that allows SQL injection. This affected controller (`TaxonomyDirectoryController`) is disabled by default and must be enabled by a developer for the exploit to be possible.\n\n","status":"published","published":"2024-05-28T17:29:03Z","modified":"2024-12-03T06:09:12.665528Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:52.534897Z"}]}}