6.8

CVE-2011-4962

Exploit
code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Silverstripe ≫ Silverstripe Version2.4.0
Silverstripe ≫ Silverstripe Version2.4.1
Silverstripe ≫ Silverstripe Version2.4.2
Silverstripe ≫ Silverstripe Version2.4.3
Silverstripe ≫ Silverstripe Version2.4.4
Silverstripe ≫ Silverstripe Version2.4.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.92% 0.89
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.openwall.com/lists/oss-security/2012/04/30/3
http://www.openwall.com/lists/oss-security/2012/04/30/1
Patch
http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6
Vendor Advisory
https://github.com/silverstripe/silverstripe-cms/commit/d15e850
Patch
Exploit