CVE-2019-14272

Vulnerability

Details

CVE-2019-14272 describes a stored cross-site scripting (XSS) issue in SilverStripe asset-admin 4.0. The vulnerability stems from insufficient sanitization of file titles entered through the CMS interface. When a user creates or edits a file record, the title field is not properly escaped before being rendered, allowing an attacker to inject arbitrary HTML or JavaScript code [2][4].

Exploitation and

Attack Vector

Exploitation requires authenticated CMS access, typically limited to users who have permission to manage files. An attacker with such access can save a malicious file title containing script payloads. When other users (including administrators) view the file list or any area where the title is displayed, the injected script executes in their browser. No interaction beyond normal page visits is needed after the malicious title is stored [2][4].

Impact

Successful exploitation leads to XSS attacks within the SilverStripe admin interface. This can result in session theft, forced actions on behalf of the victim, defacement, or exfiltration of sensitive information displayed in the CMS. Because the attack originates from a trusted domain, conventional XSS filters may not prevent it [2].

Mitigation

Users should upgrade to a patched version of the SilverStripe framework. The security advisory from FriendsOfPHP indicates a fix is available, and the vendor's release channel lists subsequent versions that address this issue [1][4]. No known exploitation in the wild has been reported as of this writing.