CVE-2023-22729: 
PHP vulnerability analysis and mitigation

CVE-2023-22729 affects the Silverstripe Framework, which is the Model-View-Controller framework powering the Silverstripe content management system. The vulnerability was discovered and disclosed in April 2023, affecting versions prior to 4.12.15. The vulnerability allows an attacker to display a link to a third-party website on a login screen by convincing a legitimate content author to follow a specially crafted link (NVD, GitHub Advisory).

The vulnerability is classified as an Open Redirect vulnerability (CWE-601) with a CVSS v3.1 base score of 6.1 MEDIUM according to NVD, while GitHub rates it as 5.4 MEDIUM. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that it can be exploited remotely with low attack complexity, requires no privileges but does need user interaction, and can affect confidentiality and integrity at a low level (NVD).

The vulnerability allows attackers to manipulate the login screen to display unauthorized third-party links, which could potentially be used in phishing attacks. The impact is primarily focused on confidentiality and integrity aspects, with low severity for both, while there is no impact on system availability (GitHub Advisory).

The recommended mitigation is to upgrade to Silverstripe Framework version 4.12.15 or above. A patch has been implemented in commit 1a5bb4c which addresses the issue by improving the handling of escaped double slashes in URLs (Framework Patch).