GCVE - cpe:2.3:a:silverstripe:silverstripe:2.3.1:rc1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:silverstripe:silverstripe:2.3.1:rc1:*:*:*:*:*:*

part: a version: 2.3.1 update: rc1

Vendor	Silverstripe (`fb3ee4e6-70c4-5017-82a7-81441bb33bd1`)
Product	Silverstripe (`a3b26fc2-6e91-5c07-b521-62f2382ac950`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/silverstripe/silverstripe-cms`	purl2cpe	2026-06-01 10:14:20.993999

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2011-4958`	vulnerable	2026-06-03 14:31:27.223028	Details available Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as demonstrated by a request to (1) admin/reports/, (2) admin/comments/, (3) admin/, (4) admin/show/, (5) admin/assets/, and (6) admin/security/. Published: 2014-04-08T14:00:00.000Z Updated: 2024-08-07T00:23:39.120Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/520050/100/0/threaded http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6 http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12 http://osvdb.org/76258 https://github.com/silverstripe/sapphire/commit/bdd6391	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5188`	vulnerable	2026-06-03 14:30:45.371367	Details available SilverStripe 2.3.x before 2.3.6 allows remote attackers to obtain sensitive information via the (1) debug_memory parameter to core/control/Director.php or (2) debug_profile parameter to main.php. Published: 2012-08-26T18:00:00.000Z Updated: 2024-08-07T04:09:39.308Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/05/01/3 http://open.silverstripe.org/changeset/98229 https://exchange.xforce.ibmcloud.com/vulnerabilities/56546 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.6 http://groups.google.com/group/silverstripe-announce/browse_thread/thread/c75fbd7926ed2725?tvc=2&fwc=1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5187`	vulnerable	2026-06-03 14:30:45.370694	Details available SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1, when running on servers with certain configurations, allows remote attackers to obtain sensitive information via a direct request to PHP files in the (1) sapphire, (2) cms, or (3) mysite folders, which reveals the installation path in an error message. Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-16T22:02:27.659Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/05/01/3 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.1 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5095`	vulnerable	2026-06-03 14:30:45.114225	Details available Cross-site scripting (XSS) vulnerability in SilverStripe 2.3.x before 2.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to DataObjectSet pagination. Published: 2012-08-26T18:00:00.000Z Updated: 2024-08-07T04:09:39.236Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/05/01/3 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.silverstripe.org/security-releases http://www.openwall.com/lists/oss-security/2012/04/30/3 https://exchange.xforce.ibmcloud.com/vulnerabilities/56546	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5094`	vulnerable	2026-06-03 14:30:45.113618	Details available The deleteinstallfiles function in control/ContentController.php in SilverStripe 2.3.x before 2.3.7 does not require ADMIN permissions, which allows remote attackers to delete index.php and "disrupt mod_rewrite-less URL routing." Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-17T00:11:21.597Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/05/01/3 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.silverstripe.org/security-releases http://www.openwall.com/lists/oss-security/2012/04/30/3 http://open.silverstripe.org/changeset/101227	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5093`	vulnerable	2026-06-03 14:30:45.113050	Details available Member_ProfileForm in security/Member.php in SilverStripe 2.3.x before 2.3.7 allows remote attackers to hijack user accounts by saving data using the email address (ID) of another user. Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-16T20:42:48.290Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/05/01/3 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.silverstripe.org/security-releases http://www.openwall.com/lists/oss-security/2012/04/30/3 http://open.silverstripe.org/changeset/100744	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5091`	vulnerable	2026-06-03 14:30:45.111995	Details available The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with CMS author privileges to execute arbitrary PHP code by changing the extension of an uploaded file. Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-16T23:20:47.546Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/05/01/3 http://open.silverstripe.org/ticket/5693 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://dl.packetstormsecurity.net/1006-exploits/silverstripe-shell.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5090`	vulnerable	2026-06-03 14:30:45.111292	Details available SilverStripe before 2.4.2 allows remote authenticated users to change administrator passwords via vectors related to admin/security. Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-17T02:32:34.578Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/05/01/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.2 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5089`	vulnerable	2026-06-03 14:30:45.110343	Details available SilverStripe before 2.4.2 does not properly restrict access to pages in draft mode, which allows remote attackers to obtain sensitive information. Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-16T18:19:25.429Z Open on db.gcve.eu Reference links http://open.silverstripe.org/changeset/110757 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.2 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5088`	vulnerable	2026-06-03 14:30:45.101934	Details available Multiple cross-site request forgery (CSRF) vulnerabilities in SilverStripe 2.3.x before 2.3.9 and 2.4.x before 2.4.3 allow remote attackers to hijack the authentication of administrators via destructive controller actions, a different vulnerability than CVE-2010-5087. Published: 2012-08-26T18:00:00.000Z Updated: 2024-08-07T04:09:38.936Z Open on db.gcve.eu Reference links http://secunia.com/advisories/41717 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://open.silverstripe.org/changeset/113275 http://holisticinfosec.org/content/view/157/45/ http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.9	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5087`	vulnerable	2026-06-03 14:30:45.098800	Details available SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism and hijack the authentication of administrators via vectors related to "form action requests" using a controller. Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-16T19:35:01.484Z Open on db.gcve.eu Reference links http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.10 http://open.silverstripe.org/changeset/115182 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.4 http://secunia.com/advisories/42346	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5080`	vulnerable	2026-06-03 14:30:45.079445	Details available The Security/changepassword URL action in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 passes a token as a GET parameter while changing a password through email, which allows remote attackers to obtain sensitive data and hijack the session via the HTTP referer logs on a server, aka "HTTP referer leakage." Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-16T20:52:56.965Z Open on db.gcve.eu Reference links http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.10 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.4 http://secunia.com/advisories/42346 http://www.openwall.com/lists/oss-security/2012/04/30/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1593`	vulnerable	2026-06-03 14:30:15.715693	Details available Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (1) the CommenterURL parameter to PostCommentForm, and in the Forum module before 0.2.5 in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via (2) the Search parameter to forums/search (aka the search script). Published: 2010-04-28T23:00:00.000Z Updated: 2024-08-07T01:28:41.998Z Open on db.gcve.eu Reference links http://www.silverstripe.org/security-releases/ http://osvdb.org/61921 http://secunia.com/advisories/38347 http://osvdb.org/61923 http://www.securityfocus.com/archive/1/509139/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-1433`	vulnerable	2026-06-03 14:29:35.560569	Details available SQL injection vulnerability in File::find (filesystem/File.php) in SilverStripe before 2.3.1 allows remote attackers to execute arbitrary SQL commands via the filename parameter. Published: 2009-04-24T23:00:00.000Z Updated: 2024-09-17T00:55:49.405Z Open on db.gcve.eu Reference links http://open.silverstripe.com/wiki/ChangeLog/2.3.1 http://open.silverstripe.com/ticket/3721 http://www.securityfocus.com/bid/34485 http://secunia.com/advisories/34633 http://osvdb.org/53589	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

SilverStripe SilverStripe 2.3.1 release candidate 1

PURL mappings

Vulnerability references

Contribute