silverstripe/taxonomy SQL Injection vulnerability · GHSA-p2v5-xcqm-4fv6 · GitHub Advisory Database · GitHub

silverstripe/taxonomy SQL Injection vulnerability

High severity GitHub Reviewed Published May 28, 2024 to the GitHub Advisory Database • Updated May 28, 2024

Package

silverstripe/taxonomy (Composer)

Affected versions

>= 1.3.0, < 1.3.1

>= 2.0.0, < 2.0.1

Patched versions

1.3.1

2.0.1

Description

There is a vulnerability in silverstripe/taxonomy module that allows SQL injection. This affected controller (TaxonomyDirectoryController) is disabled by default and must be enabled by a developer for the exploit to be possible.

References

Published to the GitHub Advisory Database May 28, 2024

Reviewed May 28, 2024

Last updated May 28, 2024

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H