Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload

中 5.4CVE-2024-32981 · GHSA-chx7-9x8h-r5mg · 17/07/2024 公開 · 17/06/2026 更新

要点

CVE-2024-32981 は silverstripe/framework, framework (silverstripe) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.35%（全脆弱性の 28.2% より高い）。
対処：5.2.16 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
silverstripe/framework Packagist	`< 5.2.16`	`5.2.16`
framework silverstripe	`< 5.2.16`	`5.2.16`

概要

Impact

A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it.

The server-side sanitisation logic has been updated to sanitise against this type of attack.

References

https://www.silverstripe.org/download/security-releases/cve-2024-32981

NVD の説明

Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS could add send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it. The server-side sanitisation logic has been updated to sanitise against this type of attack in version 5.2.16. All users are advised to upgrade. There are no known workarounds for this vulnerability.