GitHub Advisory DatabaseGHSA-CHX7-9X8H-R5MGSilverstripe Framework has a Cross-site Scripting vulnerability with encoded payload
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
16.0%
Impact
A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn’t catch it.
The server-side sanitisation logic has been updated to sanitise against this type of attack.
References
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| silverstripe | framework | * | cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:* |
References
github.com/advisories/GHSA-chx7-9x8h-r5mg
github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2024-32981.yaml
github.com/silverstripe/silverstripe-framework/commit/b8d20dc9d531550e06fd7da7a0eafa551922e2e1
github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-chx7-9x8h-r5mg
nvd.nist.gov/vuln/detail/CVE-2024-32981
www.silverstripe.org/download/security-releases/cve-2024-32981
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
16.0%