CVE-2024-53277: fallo de gravedad media en silverstripe-framework
Cross-site Scripting in form messages in silverstripe framework
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.3%
Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In some cases, form messages can contain HTML markup. This is an intentional feature, allowing links and other relevant HTML markup for the given message. Some form messages include content that the user can provide. There are scenarios in the CMS where that content doesn't get correctly sanitised prior to being included in the form message, resulting in an XSS vulnerability. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Productos afectados
silverstripe · silverstripe-frameworkCVEs relacionadas — silverstripe-framework
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-22728MEDIUMSilverstripe Framework has missing permission check of canView in GridFieldPrintButtonEPSS 0.5%CVE-2023-22729MEDIUMSilverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen EPSS 0.4%CVE-2023-48714MEDIUMRecord titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleterEPSS 0.4%CVE-2024-32981MEDIUMCross-site Scripting vulnerability with encoded payload in silverstripe/frameworkEPSS 0.3%CVE-2025-30148MEDIUMSilverstripe Framework has a XSS vulnerability in HTML editorEPSS 0.3%CVE-2026-54720MEDIUMSilverstripe Framework: Possible XSS attack through media embedEPSS 0.3%