What this actually is.
Technical background, root cause, and affected surface.
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.
- Vendor
- SilverStripe
- Affected Product
- SilverStripe
- CVE
- CVE-2015-8606
- Securin ID
- 2015-CSW-09-1009
- Status
- Fixed
- Date
- November 5, 2015
- Severity
- Medium
- CVSS Score
- 6.1
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
Issue 1: The POST Request of the variable Locale in the new member form is vulnerable to XSS.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
User’s session cookie & end-user files disclosure.
Hijack the user’s session & take over the account.
Installation of Trojan horse programs.
Redirection of the user to some other page or site.
Modification to the presentation of content
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Download the patch release advised as per the vendor.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vulnerability Disclosure in SilverStripe CMS & Framework and Reported
Vendor Response
Vendor Released Fix
Public disclosed
CVE Assigned
Disclosed 11 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.