Vulnerability · Published Jun 8, 2021 · Assigned by mitre

CVE-2020-25817

Medium 4.8

In plain English

A medium-severity security flaw in the silverstripe/framework package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.8Medium

Exploit odds (30 days)0.8%top 42.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving external or user submitted data in custom project code, it can lead to vulnerabilities such as XSS on HTML output rendered through this custom code. This is now mitigated by disabling external entities during parsing. (The correct CVE ID year is 2020 [CVE-2020-25817, not CVE-2021-25817]).

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	silverstripe/framework	4.7.4	GHSA-3vjc-5x79-m9r8

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.silverstripe.org/download/security-releases/ x_refsource_CONFIRM
https://www.silverstripe.org/blog/tag/release x_refsource_MISC
https://forum.silverstripe.org/c/releases x_refsource_MISC
https://www.silverstripe.org/download/security-releases/cve-2020-25817 x_refsource_MISC