-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/framework | composer | < 3.1.21 | 3.1.21 |
| silverstripe/framework | composer | >= 3.2.0, < 3.2.6 | 3.2.6 |
| silverstripe/framework | composer | >= 3.3.0, < 3.3.4 | 3.3.4 |
| silverstripe/framework | composer | >= 3.4.0, < 3.4.2 | 3.4.2 |
Miggo AIRoot Cause AnalysisThe core vulnerability stems from two key mechanisms: 1) Form::httpSubmission's failure to exclude readonly fields when loading request data, allowing malicious input to persist in the form state. 2) ReadonlyField's Value method (and similar fields) rendering this persisted data without proper escaping when configured with 'dontEscape'. The patch explicitly addresses both by adding field filtering in Form.php and refining escaping logic via casting helpers in ReadonlyField.php. The combination of these two vulnerable functions creates the XSS vector described in the advisory.