CVE-2021-27938
Medium
Description
A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL.
SeverityMedium
CVSS6.1
Exploit probability—
ProductSymbiote Silverstripe Queued Jobs
PublishedMar 16, 2021
First seenMar 16, 2021
How to fix
Update
- symbiote silverstripe_queued_jobs3.0.2, 3.1.4, 4.0.7, 4.1.2, 4.2.4, 4.3.3, 4.4.3, 4.5.1, 4.6.4 or later
- symbiote/silverstripe-queuedjobs3.0.2, 3.1.4, 4.0.7, 4.1.2, 4.2.4, 4.3.3, 4.4.3, 4.5.1, 4.6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| symbiote silverstripe_queued_jobs | 3.0.0 ≤ v < 3.0.2, 3.1.0 ≤ v < 3.1.4, 4.0.0 ≤ v < 4.0.7, 4.1.0 ≤ v < 4.1.2, 4.2.0 ≤ v < 4.2.4, 4.3.0 ≤ v < 4.3.3, 4.4.0 ≤ v < 4.4.3, 4.5.0 ≤ v < 4.5.1, 4.6.0 ≤ v < 4.6.4 | 3.0.2, 3.1.4, 4.0.7, 4.1.2, 4.2.4, 4.3.3, 4.4.3, 4.5.1, 4.6.4 |
| symbiote/silverstripe-queuedjobsPackagist | 3.0.0 ≤ v < 3.0.2, 3.1.0 ≤ v < 3.1.4, 4.0.0 ≤ v < 4.0.7, 4.1.0 ≤ v < 4.1.2, 4.2.0 ≤ v < 4.2.4, 4.3.0 ≤ v < 4.3.3, 4.4.0 ≤ v < 4.4.3, 4.5.0 ≤ v < 4.5.1, 4.6.0 ≤ v < 4.6.4 | 3.0.2, 3.1.4, 4.0.7, 4.1.2, 4.2.4, 4.3.3, 4.4.3, 4.5.1, 4.6.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.