GCVE - cpe:2.3:a:silverstripe:silverstripe:2.3.8:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:silverstripe:silverstripe:2.3.8:*:*:*:*:*:*:*

part: a version: 2.3.8 update: *

Vendor	Silverstripe (`fb3ee4e6-70c4-5017-82a7-81441bb33bd1`)
Product	Silverstripe (`a3b26fc2-6e91-5c07-b521-62f2382ac950`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/silverstripe/silverstripe-cms`	purl2cpe	2026-06-01 10:14:20.994025

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-4968`	vulnerable	2026-06-03 14:32:26.391032	Details available Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted string to the AbsoluteLinks, (2) BigSummary, (3) ContextSummary, (4) EscapeXML, (5) FirstParagraph, (6) FirstSentence, (7) Initial, (8) LimitCharacters, (9) LimitSentences, (10) LimitWordCount, (11) LimitWordCountXML, (12) Lower, (13) LowerCase, (14) NoHTML, (15) Summary, (16) Upper, (17) UpperCase, or (18) URL method in a template, different vectors than CVE-2012-0976. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-16T19:11:05.166Z Open on db.gcve.eu Reference links http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13 https://github.com/silverstripe/sapphire/commit/0085876	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4961`	vulnerable	2026-06-03 14:31:27.233902	Details available SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDIT_PERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-16T17:19:06.700Z Open on db.gcve.eu Reference links https://github.com/silverstripe/sapphire/commit/de1f070 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4960`	vulnerable	2026-06-03 14:31:27.233234	Details available SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-17T00:52:26.777Z Open on db.gcve.eu Reference links https://github.com/silverstripe/sapphire/commit/fef7c32 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4959`	vulnerable	2026-06-03 14:31:27.232518	Details available SQL injection vulnerability in the addslashes method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6, when connected to a MySQL database using far east character encodings, allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-17T02:10:53.830Z Open on db.gcve.eu Reference links https://github.com/silverstripe/sapphire/commit/73cca09 https://github.com/silverstripe/silverstripe-cms/commit/b5ea2f6 https://github.com/silverstripe/sapphire/commit/ca78784 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4958`	vulnerable	2026-06-03 14:31:27.227147	Details available Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as demonstrated by a request to (1) admin/reports/, (2) admin/comments/, (3) admin/, (4) admin/show/, (5) admin/assets/, and (6) admin/security/. Published: 2014-04-08T14:00:00.000Z Updated: 2024-08-07T00:23:39.120Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/520050/100/0/threaded http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6 http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12 http://osvdb.org/76258 https://github.com/silverstripe/sapphire/commit/bdd6391	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5090`	vulnerable	2026-06-03 14:30:45.111422	Details available SilverStripe before 2.4.2 allows remote authenticated users to change administrator passwords via vectors related to admin/security. Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-17T02:32:34.578Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/05/01/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.2 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5089`	vulnerable	2026-06-03 14:30:45.110476	Details available SilverStripe before 2.4.2 does not properly restrict access to pages in draft mode, which allows remote attackers to obtain sensitive information. Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-16T18:19:25.429Z Open on db.gcve.eu Reference links http://open.silverstripe.org/changeset/110757 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.2 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5088`	vulnerable	2026-06-03 14:30:45.102063	Details available Multiple cross-site request forgery (CSRF) vulnerabilities in SilverStripe 2.3.x before 2.3.9 and 2.4.x before 2.4.3 allow remote attackers to hijack the authentication of administrators via destructive controller actions, a different vulnerability than CVE-2010-5087. Published: 2012-08-26T18:00:00.000Z Updated: 2024-08-07T04:09:38.936Z Open on db.gcve.eu Reference links http://secunia.com/advisories/41717 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://open.silverstripe.org/changeset/113275 http://holisticinfosec.org/content/view/157/45/ http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.9	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5087`	vulnerable	2026-06-03 14:30:45.098931	Details available SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism and hijack the authentication of administrators via vectors related to "form action requests" using a controller. Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-16T19:35:01.484Z Open on db.gcve.eu Reference links http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.10 http://open.silverstripe.org/changeset/115182 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.4 http://secunia.com/advisories/42346	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5080`	vulnerable	2026-06-03 14:30:45.080146	Details available The Security/changepassword URL action in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 passes a token as a GET parameter while changing a password through email, which allows remote attackers to obtain sensitive data and hijack the session via the HTTP referer logs on a server, aka "HTTP referer leakage." Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-16T20:52:56.965Z Open on db.gcve.eu Reference links http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.10 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.4 http://secunia.com/advisories/42346 http://www.openwall.com/lists/oss-security/2012/04/30/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5079`	vulnerable	2026-06-03 14:30:45.072925	Details available SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) autologin, (3) "forgot password" functionality, and (4) password salts, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-16T21:07:45.153Z Open on db.gcve.eu Reference links http://open.silverstripe.org/changeset/114505 http://open.silverstripe.org/changeset/114503 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://open.silverstripe.org/changeset/114504 http://www.openwall.com/lists/oss-security/2012/04/30/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5078`	vulnerable	2026-06-03 14:30:45.072181	Details available SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain version information via a direct request to (1) apphire/silverstripe_version or (2) cms/silverstripe_version. Published: 2012-09-17T17:00:00.000Z Updated: 2024-08-07T04:09:38.915Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/05/01/3 http://www.osvdb.org/69888 http://www.securityfocus.com/bid/45367 http://secunia.com/advisories/42346 http://www.openwall.com/lists/oss-security/2012/04/30/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-4824`	vulnerable	2026-06-03 14:30:44.230462	Details available SQL injection vulnerability in the augmentSQL method in core/model/Translatable.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when the Translatable extension is enabled, allows remote attackers to execute arbitrary SQL commands via the locale parameter. Published: 2012-09-17T17:00:00.000Z Updated: 2024-08-07T04:02:29.642Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/63989 http://open.silverstripe.org/changeset/114517 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://open.silverstripe.org/changeset/114515 http://www.securityfocus.com/bid/45367	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-4823`	vulnerable	2026-06-03 14:30:44.229132	Details available Cross-site scripting (XSS) vulnerability in the httpError method in sapphire/core/control/RequestHandler.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when custom error handling is not used, allows remote attackers to inject arbitrary web script or HTML via "missing URL actions." Published: 2012-09-17T17:00:00.000Z Updated: 2024-08-07T04:02:30.451Z Open on db.gcve.eu Reference links http://www.osvdb.org/69886 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://www.securityfocus.com/bid/45367 http://secunia.com/advisories/42346 https://exchange.xforce.ibmcloud.com/vulnerabilities/63988	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.