CVE-2020-25817

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving external or user submitted data in custom project code, it can lead to vulnerabilities such as XSS on HTML output rendered through this custom code. This is now mitigated by disabling external entities during parsing. (The correct CVE ID year is 2020 [CVE-2020-25817, not CVE-2021-25817]).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://forum.silverstripe.org/c/releasesRelease Notes, Vendor Advisory
https://www.silverstripe.org/blog/tag/releaseRelease Notes, Vendor Advisory
https://www.silverstripe.org/download/security-releases/Vendor Advisory
https://www.silverstripe.org/download/security-releases/cve-2020-25817Broken Link
https://forum.silverstripe.org/c/releasesRelease Notes, Vendor Advisory
https://www.silverstripe.org/blog/tag/releaseRelease Notes, Vendor Advisory
https://www.silverstripe.org/download/security-releases/Vendor Advisory
https://www.silverstripe.org/download/security-releases/cve-2020-25817Broken Link

Timeline

Published: Jun 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-25828.2Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 1 CVE-2020-258206.5BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document th CVE-2020-258217.5peg-markdown 0.4.14 has a NULL pointer dereference in process_raw_blocks in markdown_lib.c. NOTE: This vulnerability only affects products t CVE-2020-258242.4Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threa CVE-2020-258257.5In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs.CVE-2020-258267.8PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp.BrowserSubprocess.exe.CVE-2020-258277.5An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHA CVE-2020-258286.1An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse CVE-2020-258297.5An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cach CVE-2020-25833.7Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected ar CVE-2020-258304.8An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP CVE-2020-258325.4Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. The vulnerability could be exploited to p