silverstripe/silverstripe-framework · Security
Reflected Cross Site Scripting (XSS) in error message
- GHSA ID
- GHSA-74j9-xhqr-6qv3
- Severity
- low
- Published
- Updated
Description
If a website has been set to the "dev" environment mode, a URL can be provided which includes an XSS payload which will be executed in the resulting error message.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')