[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20151217202749.7B90E42E1E7@smtpvbsrv1.mitre.org>
Date: Thu, 17 Dec 2015 15:27:49 -0500 (EST)
From: cve-assign@...re.org
To: disclose@...ersecurityworks.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Cross site scripting vulnerability (XSS) in SilverStripe CMS & Framework v3.2.0
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> http://www.silverstripe.org/download/security-releases/ss-2015-026
>
> A high level XSS risk has been identified in the encoding of
> validation messages in certain FormField classes.
>
> Certain fields such as the NumericField and DropdownField have been
> identified, but any form field which presents any invalid content as a
> part of its validation response will be at risk.
> Proof of Concept URL:
> =================
> http://localhost/Silverstripe/admin/security/EditForm/field/Members/item/new/ItemEditForm/
>
> Parameter
> ==============
> Locale
> FailedLoginCount
Use CVE-2015-8606.
Our understanding is that "Locale" and "FailedLoginCount" are a
different way of describing the same problem, relative to
"NumericField" and "DropdownField" above. For example, part of the
source code is:
$fields->replaceField('Locale', new DropdownField (
'Locale',
$this->fieldLabel('Locale'),
In other words, mentioning "Locale" and "FailedLoginCount" does not
mean that the number of known independent attack vectors is being
increased from 2 to 4.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJWcxpfAAoJEL54rhJi8gl5LgUP/iMvdIPTWjqz9ayl2/IuJ417
FoTsKYwgEowSc/i1/RdHFTwZ3qUwbZqVIPd9Zp2M90qs39CH6cdhsJN0icpmfMzm
LcXcV6dTYcA2QAeDVNJv/pGAUSS/S4YjLuvjcZ59ZJLpKjom7yAA/BQMpM1R60ea
ScIE3pNH02l/1Bl7eh31kBkoZcuHXN8dJdVwCnRyk384yu5JEWu2PoBF9hXkOdgq
sS1YJvtlpHmC79/oZuTH2ilQ5LoivXoCF8BAxpxqOU9TsD6hHRfq84YSd4wYfsge
TDRlxNInl/X3YSMZW4mUrMWrM1CXOpZWe5K+E/zNu84Dq0Co4rucNkKY2GXDFJnq
OI/dYnuZ3aatiC+YG00RFEh9XlLUTdIGwhhi4+OCbC3RmAxEsakaN6QbEmHTDLmL
XLzI4SRoV6w1yb8QpBdQwrAcNpGNlTZL+89vJGlH8c5VgGTc9nUoM5HYzcNCjvT0
gOUJIdX9TEV+D3dxBq1YwuHe+oLxdjLSxp9cGH/hxP6Fb+SHK9pXMf0RRaKo/0tZ
5OQ/CgR/ABWYanh2dMmLRpSFDEzoWyj+8XscswlYZUK4HtkgyltjKaVIcxGef7gY
q147GFV+Cw5wgGlxMDcJAe+oNQ5yPdV2AWI4l1tPWXVcDVSSC96pfuB4eDET2tpI
LJI6N6mT6Ln4AtAnbWKL
=v/y/
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
