-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from using strip_tags() instead of proper encoding when handling $_SERVER['REQUEST_URI'] in URL rewriting logic. The patch replaces strip_tags() with Convert::raw2att() in both SSViewer::process() and SSTemplateParser's template processing functions. These locations directly output user-controlled URL data without adequate HTML entity encoding, making them the root cause of reflected XSS when Internet Explorer sends unencoded payloads.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/framework | composer | <= 3.0.12 | 3.0.13 |
| silverstripe/framework | composer | >= 3.1.0, <= 3.1.11 | 3.1.12 |
Ongoing coverage of React2Shell