GHSA-mpqj-f4v3-334h: 
PHP vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in the VersionedRequestFilter component of Silverstripe Framework, identified as SS-2016-007. The vulnerability affects versions 3.3.0 to 3.3.2 and 3.4.0, and was fixed in versions 3.3.3 and 3.4.1. The issue was discovered and reported by Matthew Daley, with the fix being released on August 15, 2016 (Silverstripe Advisory).

The vulnerability occurs in the VersionedRequestFilter component when a user request cannot access the requested stage. In such cases, an error message is generated for display on the CMS login page. The vulnerability stems from the URL of the requested page being interpolated into the error message without proper escaping, allowing arbitrary HTML injection into the CMS login page. The issue has been assigned a CVSS v3.1 base score of 6.1 (Moderate severity), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (GitHub Advisory).

The vulnerability allows attackers to inject arbitrary HTML into the CMS login page through the unescaped URL parameter. This could potentially lead to cross-site scripting attacks, affecting the confidentiality and integrity of the system with low impact (GitHub Advisory).

The vulnerability requires no privileges and has low attack complexity, though user interaction is required. The attack vector is network-based, making it exploitable remotely (GitHub Advisory).

The vulnerability has been fixed in Silverstripe Framework versions 3.3.3 and 3.4.1. The fix involves properly encoding the user-supplied URL using Convert::raw2xml before embedding it into the page (Framework Commit).