-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how error messages are rendered in HTML context. The patched commit modifies the supportsHTML() method to add fallback checks to $_SERVER['HTTP_ACCEPT'] when no request object exists. This indicates the original implementation didn't properly detect HTML contexts in all error scenarios, allowing XSS payloads to execute when dev mode was active. The function's role in determining output format makes it the logical point where improper context detection would enable XSS vulnerabilities.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/framework | composer | < 5.3.8 | 5.3.8 |