CVE-2020-25102

Name of the Vulnerable Software and Affected Versions silverstripe-advancedreports versions 1.0 through 2.0

Description The issue allows for Cross-Site Scripting (XSS) due to the possibility of injecting and storing malicious JavaScript code. This affects the "report preview" when an SVG document is provided in the Description parameter, specifically at the "admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item" endpoint.

Recommendations For versions 1.0 through 2.0, consider disabling the report preview feature in the admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item endpoint until a patch is available. Restrict access to the Description parameter to minimize the risk of exploitation. Avoid using the Description parameter in the affected endpoint until the issue is resolved.