Silverstripe Form Capture vulnerable to Stored Cross-Site Scripting

Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to perform a Cross-Site Scripting attack. The vulnerability was initially patched in version 1.0.2, and version 1.1.0 includes this patch. The bug was then accidentally re-introduced during a merge error, and has been re-patched in versions 2.2.5 and 3.1.1. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)

Silverstripe Form Capture 跨站脚本漏洞

Silverstripe Form Capture是英国Bigfork的提供捕获简单Silverstripe表单方法，并为用户提供友好的管理界面。 Silverstripe Form Capture 0.2.0到0.2.3, 1.0.0到1.0.1, 2.0.0到2.2.4、3.0.0到3.1.0版本存在安全漏洞，该漏洞源于提交表单时存在不正确的转义，攻击者利用该漏洞可以执行跨站脚本攻击。

N/A

N/A