[silverstripe/framework] Stored XSS using uppercase characters in HTMLEditor

A malicious content author could add a Javascript payload to the href attribute of a link. A similar issue was identified and fixed via CVE-2022-28803. However, the fix didn’t account for the casing of the href attribute. An attacker must have access to the CMS to exploit this issue.

References

• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-37430.yaml
• https://www.silverstripe.org/download/security-releases/cve-2022-37430
• https://github.com/advisories/GHSA-qw4w-vq8v-2wcv