PT-2024-25029 · Silverstripe · Silverstripe/Framework

Jack Wallace · Published 2024-07-17 · Updated 2025-09-04 · CVE-2024-32981

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe framework versions prior to 5.2.16

Description A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it.

Recommendations For versions prior to 5.2.16, upgrade to version 5.2.16 or later to resolve the issue. At the moment, there is no information about other workarounds for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-32981

GHSA-CHX7-9X8H-R5MG

Affected Products

Silverstripe/Framework

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32981.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2024-32981.yaml · Exploit
• https://github.com/silverstripe/silverstripe-framework/commit/b8d20dc9d531550e06fd7da7a0eafa551922e2e1 · Patch
• https://silverstripe.org/download/security-releases/cve-2024-32981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32981 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32981 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-chx7-9x8h-r5mg · Vendor Advisory
• https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-chx7-9x8h-r5mg · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://t.me/cvedetector/1125 · Telegram Post
• https://t.me/cveNotify/134259 · Telegram Post