PT-2025-2953 · Silverstripe · Silverstripe/Framework

Leo Diamat · Published 2025-01-14 · Updated 2025-09-04 · CVE-2024-53277

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe Framework versions prior to 5.3.8

Description The Silverstripe Framework, a PHP framework powering the Silverstripe CMS, has an intentional feature allowing form messages to contain HTML markup for links and other relevant content. However, some form messages include user-provided content that does not get correctly sanitized before being included, resulting in an XSS vulnerability. There are no known workarounds for this issue.

Recommendations For Silverstripe Framework versions prior to 5.3.8, upgrade to version 5.3.8 to address the vulnerability. As a temporary workaround, consider restricting user input in form messages to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-53277

GHSA-FF6Q-3C9C-6CF5

Affected Products

Silverstripe/Framework

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53277.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2024-53277.yaml · Exploit
• https://github.com/silverstripe/silverstripe-framework/commit/74904f539347b7d1f8c5b5fb9e28d62ff251ee00 · Patch
• https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-ff6q-3c9c-6cf5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53277 · Security Note
• https://silverstripe.org/download/security-releases/cve-2024-53277 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53277 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ff6q-3c9c-6cf5 · Vendor Advisory
• https://github.com/silverstripe/silverstripe-framework · Note
• https://t.me/cvenotify/107401 · Telegram Post
• https://t.me/cvedetector/15386 · Telegram Post
• https://twitter.com/CVEnew/status/1879490171080749403 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1879438858611208634 · Twitter Post
• https://t.me/cveNotify/134282 · Telegram Post