[silverstripe/framework] Stored XSS in link tags added via XHR in SilverStripe Framework

SilverStripe Framework 4.x prior to 4.10.9 is vulnerable to cross-site scripting inside the href attribute of an HTML hyperlink, which can be added to website content via XMLHttpRequest (XHR) by an authenticated CMS user.

References

• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2022-28803.yaml
• https://www.silverstripe.org/download/security-releases/cve-2022-28803
• https://nvd.nist.gov/vuln/detail/CVE-2022-28803
• https://github.com/advisories/GHSA-rppc-655v-7j3c