CVE-2011-4958 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2011-4958

Modified

More Info Official Page

Source-secalert@redhat.com

Published At-08 Apr, 2014 | 14:22

Updated At-06 May, 2026 | 22:30

Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders, as demonstrated by a request to (1) admin/reports/, (2) admin/comments/, (3) admin/, (4) admin/show/, (5) admin/assets/, and (6) admin/security/.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

>>silverstripe>>Versions up to 2.3.12(inclusive)

cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*

>>silverstripe>>2.3.0

cpe:2.3:a:silverstripe:silverstripe:2.3.0:*:*:*:*:*:*:*

>>silverstripe>>2.3.0

cpe:2.3:a:silverstripe:silverstripe:2.3.0:rc1:*:*:*:*:*:*

>>silverstripe>>2.3.0

cpe:2.3:a:silverstripe:silverstripe:2.3.0:rc2:*:*:*:*:*:*

>>silverstripe>>2.3.0

cpe:2.3:a:silverstripe:silverstripe:2.3.0:rc3:*:*:*:*:*:*

>>silverstripe>>2.3.1

cpe:2.3:a:silverstripe:silverstripe:2.3.1:*:*:*:*:*:*:*

>>silverstripe>>2.3.1

cpe:2.3:a:silverstripe:silverstripe:2.3.1:rc1:*:*:*:*:*:*

>>silverstripe>>2.3.1

cpe:2.3:a:silverstripe:silverstripe:2.3.1:rc2:*:*:*:*:*:*

>>silverstripe>>2.3.2

cpe:2.3:a:silverstripe:silverstripe:2.3.2:*:*:*:*:*:*:*

>>silverstripe>>2.3.3

cpe:2.3:a:silverstripe:silverstripe:2.3.3:*:*:*:*:*:*:*

>>silverstripe>>2.3.4

cpe:2.3:a:silverstripe:silverstripe:2.3.4:*:*:*:*:*:*:*

>>silverstripe>>2.3.5

cpe:2.3:a:silverstripe:silverstripe:2.3.5:*:*:*:*:*:*:*

>>silverstripe>>2.3.6

cpe:2.3:a:silverstripe:silverstripe:2.3.6:*:*:*:*:*:*:*

>>silverstripe>>2.3.7

cpe:2.3:a:silverstripe:silverstripe:2.3.7:*:*:*:*:*:*:*

>>silverstripe>>2.3.8

cpe:2.3:a:silverstripe:silverstripe:2.3.8:*:*:*:*:*:*:*

>>silverstripe>>2.3.9

cpe:2.3:a:silverstripe:silverstripe:2.3.9:*:*:*:*:*:*:*

>>silverstripe>>2.3.10

cpe:2.3:a:silverstripe:silverstripe:2.3.10:*:*:*:*:*:*:*

>>silverstripe>>2.3.11

cpe:2.3:a:silverstripe:silverstripe:2.3.11:*:*:*:*:*:*:*

>>silverstripe>>2.4.0

cpe:2.3:a:silverstripe:silverstripe:2.4.0:*:*:*:*:*:*:*

>>silverstripe>>2.4.1

cpe:2.3:a:silverstripe:silverstripe:2.4.1:*:*:*:*:*:*:*

>>silverstripe>>2.4.2

cpe:2.3:a:silverstripe:silverstripe:2.4.2:*:*:*:*:*:*:*

>>silverstripe>>2.4.3

cpe:2.3:a:silverstripe:silverstripe:2.4.3:*:*:*:*:*:*:*

>>silverstripe>>2.4.4

cpe:2.3:a:silverstripe:silverstripe:2.4.4:*:*:*:*:*:*:*

>>silverstripe>>2.4.5

cpe:2.3:a:silverstripe:silverstripe:2.4.5:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12	secalert@redhat.com	N/A
http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6	secalert@redhat.com	N/A
http://osvdb.org/76258	secalert@redhat.com	N/A
http://secunia.com/advisories/46390	secalert@redhat.com	Vendor Advisory
http://www.rul3z.de/advisories/SSCHADV2011-024.txt	secalert@redhat.com	Exploit
http://www.securityfocus.com/archive/1/520050/100/0/threaded	secalert@redhat.com	N/A
https://github.com/silverstripe/sapphire/commit/16c3235	secalert@redhat.com	Exploit Patch
https://github.com/silverstripe/sapphire/commit/52a895f	secalert@redhat.com	Exploit Patch
https://github.com/silverstripe/sapphire/commit/bdd6391	secalert@redhat.com	Exploit Patch
http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12	af854a3a-2127-422b-91ae-364da2661108	N/A
http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6	af854a3a-2127-422b-91ae-364da2661108	N/A
http://osvdb.org/76258	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/46390	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://www.rul3z.de/advisories/SSCHADV2011-024.txt	af854a3a-2127-422b-91ae-364da2661108	Exploit
http://www.securityfocus.com/archive/1/520050/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108	N/A
https://github.com/silverstripe/sapphire/commit/16c3235	af854a3a-2127-422b-91ae-364da2661108	Exploit Patch
https://github.com/silverstripe/sapphire/commit/52a895f	af854a3a-2127-422b-91ae-364da2661108	Exploit Patch
https://github.com/silverstripe/sapphire/commit/bdd6391	af854a3a-2127-422b-91ae-364da2661108	Exploit Patch

Hyperlink: http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://osvdb.org/76258

Source: secalert@redhat.com

Resource: N/A

Hyperlink: http://secunia.com/advisories/46390

Source: secalert@redhat.com

Resource:

Vendor Advisory

Hyperlink: http://www.rul3z.de/advisories/SSCHADV2011-024.txt

Source: secalert@redhat.com

Resource:

Exploit

Hyperlink: http://www.securityfocus.com/archive/1/520050/100/0/threaded

Source: secalert@redhat.com

Resource: N/A

Hyperlink: https://github.com/silverstripe/sapphire/commit/16c3235

Source: secalert@redhat.com

Resource:

Exploit

Patch

Hyperlink: https://github.com/silverstripe/sapphire/commit/52a895f

Source: secalert@redhat.com

Resource:

Exploit

Patch

Hyperlink: https://github.com/silverstripe/sapphire/commit/bdd6391

Source: secalert@redhat.com

Resource:

Exploit

Patch

Hyperlink: http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.3.12

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://doc.silverstripe.org/sapphire/en/trunk/changelogs/2.4.6

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://osvdb.org/76258

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://secunia.com/advisories/46390

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: http://www.rul3z.de/advisories/SSCHADV2011-024.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Hyperlink: http://www.securityfocus.com/archive/1/520050/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://github.com/silverstripe/sapphire/commit/16c3235

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Patch

Hyperlink: https://github.com/silverstripe/sapphire/commit/52a895f

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Patch

Hyperlink: https://github.com/silverstripe/sapphire/commit/bdd6391

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Patch