Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE
TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting silverstripe/admin.
Only Silverstripe CMS 4 is affected by this issue. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in silverstripe/admin.
Silverstripe CMS 5 is not affected by those vulnerabilities because it uses TinyMCE 6.
You can find more information about the underlying vulnerabilities in those GitHub security advisories:
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | silverstripe/admin | < 1.13.6 | 1.13.6 |
Referencias
- https://github.com/silverstripe/silverstripe-admin/security/advisories/GHSA-4q66-g4mm-8rg5
- https://github.com/silverstripe/silverstripe-admin/commit/cafc1c4de58f1553b019dc2f8a62f835cabdbeb2
- https://github.com/advisories/GHSA-5h9g-x5rv-25wg
- https://github.com/advisories/GHSA-w7jx-j77m-wp65
- https://github.com/silverstripe/silverstripe-admin
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N- Debilidad (CWE)
-- Plataforma
- Composer
- Paquete
silverstripe/admin- Publicada
- 31.07.2023
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-4q66-g4mm-8rg5 - CC BY 4.0
Historial de vulnerabilidades: silverstripe/admin
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 8
- Primera → última
- 10.2021 05.2024
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Media 7
- Baja 1
Divulgaciones por año
- 2021: 1
- 2022: 2
- 2023: 3
- 2024: 2
- 2025: 0
- 2026: 0
-
Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.