CVE-2010-1593

Description

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script).

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/55839

https://exchange.xforce.ibmcloud.com/vulnerabilities/55838

http://www.silverstripe.org/security-releases/

http://www.securityfocus.com/bid/37923

http://www.securityfocus.com/archive/1/509139/100/0/threaded

http://secunia.com/advisories/38347

http://secunia.com/advisories/38290

http://osvdb.org/61923

http://osvdb.org/61921

http://open.silverstripe.org/wiki/ChangeLog/2.3.5

http://groups.google.com/group/silverstripe-announce/browse_thread/thread/f51749342eee9456

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3