Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload

TRUNG BÌNH 5.4CVE-2024-32981 · GHSA-chx7-9x8h-r5mg · Công bố 17/07/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-32981 là lỗ hổng mức TRUNG BÌNH (CVSS 5.4) ảnh hưởng silverstripe/framework, framework (silverstripe).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.35%, cao hơn 28.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 5.2.16 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
silverstripe/framework Packagist	`< 5.2.16`	`5.2.16`
framework silverstripe	`< 5.2.16`	`5.2.16`

Mô tả

Impact

A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it.

The server-side sanitisation logic has been updated to sanitise against this type of attack.

References

https://www.silverstripe.org/download/security-releases/cve-2024-32981

Mô tả của NVD

Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS could add send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it. The server-side sanitisation logic has been updated to sanitise against this type of attack in version 5.2.16. All users are advised to upgrade. There are no known workarounds for this vulnerability.