GCVE - cpe:2.3:a:silverstripe:silverstripe:2.3.9:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:silverstripe:silverstripe:2.3.9:*:*:*:*:*:*:*

part: a version: 2.3.9 update: *

Vendor	Silverstripe (`fb3ee4e6-70c4-5017-82a7-81441bb33bd1`)
Product	Silverstripe (`a3b26fc2-6e91-5c07-b521-62f2382ac950`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/silverstripe/silverstripe-cms`	purl2cpe	2026-06-01 10:14:20.994029

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-4968`	vulnerable	2026-06-03 14:32:26.391539	Details available Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted string to the AbsoluteLinks, (2) BigSummary, (3) ContextSummary, (4) EscapeXML, (5) FirstParagraph, (6) FirstSentence, (7) Initial, (8) LimitCharacters, (9) LimitSentences, (10) LimitWordCount, (11) LimitWordCountXML, (12) Lower, (13) LowerCase, (14) NoHTML, (15) Summary, (16) Upper, (17) UpperCase, or (18) URL method in a template, different vectors than CVE-2012-0976. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-16T19:11:05.166Z Open on db.gcve.eu Reference links http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13 https://github.com/silverstripe/sapphire/commit/0085876	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4961`	vulnerable	2026-06-03 14:31:27.233919	Details available SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDIT_PERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-16T17:19:06.700Z Open on db.gcve.eu Reference links https://github.com/silverstripe/sapphire/commit/de1f070 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4960`	vulnerable	2026-06-03 14:31:27.233251	Details available SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-17T00:52:26.777Z Open on db.gcve.eu Reference links https://github.com/silverstripe/sapphire/commit/fef7c32 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4959`	vulnerable	2026-06-03 14:31:27.232534	Details available SQL injection vulnerability in the addslashes method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6, when connected to a MySQL database using far east character encodings, allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-17T02:10:53.830Z Open on db.gcve.eu Reference links https://github.com/silverstripe/sapphire/commit/73cca09 https://github.com/silverstripe/silverstripe-cms/commit/b5ea2f6 https://github.com/silverstripe/sapphire/commit/ca78784 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4958`	vulnerable	2026-06-03 14:31:27.227640	Details available Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as demonstrated by a request to (1) admin/reports/, (2) admin/comments/, (3) admin/, (4) admin/show/, (5) admin/assets/, and (6) admin/security/. Published: 2014-04-08T14:00:00.000Z Updated: 2024-08-07T00:23:39.120Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/520050/100/0/threaded http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6 http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12 http://osvdb.org/76258 https://github.com/silverstripe/sapphire/commit/bdd6391	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5090`	vulnerable	2026-06-03 14:30:45.111438	Details available SilverStripe before 2.4.2 allows remote authenticated users to change administrator passwords via vectors related to admin/security. Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-17T02:32:34.578Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/05/01/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.2 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5089`	vulnerable	2026-06-03 14:30:45.110491	Details available SilverStripe before 2.4.2 does not properly restrict access to pages in draft mode, which allows remote attackers to obtain sensitive information. Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-16T18:19:25.429Z Open on db.gcve.eu Reference links http://open.silverstripe.org/changeset/110757 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.2 http://www.openwall.com/lists/oss-security/2012/04/30/1 http://www.openwall.com/lists/oss-security/2012/04/30/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5087`	vulnerable	2026-06-03 14:30:45.098947	Details available SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism and hijack the authentication of administrators via vectors related to "form action requests" using a controller. Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-16T19:35:01.484Z Open on db.gcve.eu Reference links http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.10 http://open.silverstripe.org/changeset/115182 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.4 http://secunia.com/advisories/42346	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5080`	vulnerable	2026-06-03 14:30:45.080169	Details available The Security/changepassword URL action in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 passes a token as a GET parameter while changing a password through email, which allows remote attackers to obtain sensitive data and hijack the session via the HTTP referer logs on a server, aka "HTTP referer leakage." Published: 2012-08-26T18:00:00.000Z Updated: 2024-09-16T20:52:56.965Z Open on db.gcve.eu Reference links http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.10 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.4 http://secunia.com/advisories/42346 http://www.openwall.com/lists/oss-security/2012/04/30/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5079`	vulnerable	2026-06-03 14:30:45.072941	Details available SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) autologin, (3) "forgot password" functionality, and (4) password salts, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors. Published: 2012-09-17T17:00:00.000Z Updated: 2024-09-16T21:07:45.153Z Open on db.gcve.eu Reference links http://open.silverstripe.org/changeset/114505 http://open.silverstripe.org/changeset/114503 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://open.silverstripe.org/changeset/114504 http://www.openwall.com/lists/oss-security/2012/04/30/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5078`	vulnerable	2026-06-03 14:30:45.072198	Details available SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain version information via a direct request to (1) apphire/silverstripe_version or (2) cms/silverstripe_version. Published: 2012-09-17T17:00:00.000Z Updated: 2024-08-07T04:09:38.915Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/05/01/3 http://www.osvdb.org/69888 http://www.securityfocus.com/bid/45367 http://secunia.com/advisories/42346 http://www.openwall.com/lists/oss-security/2012/04/30/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-4824`	vulnerable	2026-06-03 14:30:44.230477	Details available SQL injection vulnerability in the augmentSQL method in core/model/Translatable.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when the Translatable extension is enabled, allows remote attackers to execute arbitrary SQL commands via the locale parameter. Published: 2012-09-17T17:00:00.000Z Updated: 2024-08-07T04:02:29.642Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/63989 http://open.silverstripe.org/changeset/114517 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://open.silverstripe.org/changeset/114515 http://www.securityfocus.com/bid/45367	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-4823`	vulnerable	2026-06-03 14:30:44.229596	Details available Cross-site scripting (XSS) vulnerability in the httpError method in sapphire/core/control/RequestHandler.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4, when custom error handling is not used, allows remote attackers to inject arbitrary web script or HTML via "missing URL actions." Published: 2012-09-17T17:00:00.000Z Updated: 2024-08-07T04:02:30.451Z Open on db.gcve.eu Reference links http://www.osvdb.org/69886 http://www.openwall.com/lists/oss-security/2012/05/01/3 http://www.securityfocus.com/bid/45367 http://secunia.com/advisories/42346 https://exchange.xforce.ibmcloud.com/vulnerabilities/63988	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.