CVE-2020-25817

Katalog CVE

CVSS 4.8 · Medium EPSS 0,82%

Kerentanan Improper Restriction of XML External Entity Reference pada silverstripe. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving external or user submitted data in custom project code, it can lead to vulnerabilities such as XSS on HTML output rendered through this custom code. This is now mitigated by disabling external entities during parsing. (The correct CVE ID year is 2020 [CVE-2020-25817, not CVE-2021-25817]).

Rincian

Terbit di NVD

8 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 56,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://forum.silverstripe.org/c/releases release notes · advisory vendor
• https://www.silverstripe.org/blog/tag/release release notes · advisory vendor
• https://www.silverstripe.org/download/security-releases/ advisory vendor
• https://www.silverstripe.org/download/security-releases/cve-2020-25817 broken link