CVE-2019-19325
Last modified
CVE-2019-19325 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). EPSS estimates a 0.69% chance of exploitation in the next 30 days.
Description
SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Silverstripe | Silverstripe | >= 4.4.0, < 4.4.5 |
| Silverstripe | Silverstripe | >= 4.5.0, < 4.5.2 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-19325?
How severe is CVE-2019-19325?
How do I fix CVE-2019-19325?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-19316When using the Azure backend with a shared access signature …7.5
- CVE-2019-19317lookupName in resolve.c in SQLite 3.30.1 omits bits from the…9.8
- CVE-2019-19318In the Linux kernel 5.3.11, mounting a crafted btrfs image t…4.4
- CVE-2019-19319In the Linux kernel before 5.2, a setxattr operation, after …6.5
- CVE-2019-1932A vulnerability in Cisco Advanced Malware Protection (AMP) f…6.7
- CVE-2019-19324Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported …7.5
- CVE-2019-19326Silverstripe CMS sites through 4.4.4 which have opted into H…5.9
- CVE-2019-19327ui/ResultView.js in Wikibase Wikidata Query Service GUI befo…6.1
- CVE-2019-19328ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service …6.1
- CVE-2019-19329In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT…6.1
- CVE-2019-1933A vulnerability in the email message scanning of Cisco Async…5.8
- CVE-2019-19330The HTTP/2 implementation in HAProxy before 2.0.10 mishandle…9.8
Are you affected by CVE-2019-19325?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST