Read the docs
TI-2024-21847 Aliases CVE-2024-32981GHSA-chx7-9x8h-r5mg

Cross-site Scripting vulnerability with encoded payload in silverstripe/framework

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS could add send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it. The server-side sanitisation logic has been updated to sanitise against this type of attack in version 5.2.16. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix Fixed silverstripe-framework (silverstripe): 5.2.16silverstripe/framework (Packagist): 5.2.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
silverstripesilverstripe-frameworkbefore 5.2.165.2.16Patch availableCNA
—silverstripe/framework (Packagist)before 5.2.165.2.16Patch availableGHSA-chx7-9x8h-r5mg
  • silverstripe-framework Vendorsilverstripe Affected before 5.2.16 Fixed in 5.2.16 Patch available CNA
  • silverstripe/framework (Packagist) Vendor— Affected before 5.2.16 Fixed in 5.2.16 Patch available GHSA-chx7-9x8h-r5mg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:*before 5.2.16Vulnerablesilverstripe
  • cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:* Versions before 5.2.16 Vulnerable ·silverstripe

Remediation

  • Fix · CNA silverstripe-framework (silverstripe) Fixed in 5.2.16
  • Fix · GHSA-chx7-9x8h-r5mg silverstripe/framework (Packagist) Fixed in 5.2.16 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-32981
  2. 2026-10-03 Alias added: GHSA-chx7-9x8h-r5mg

References

Patch 1

Advisory 3

Other 2

  • TI-2022-17852 Silverstripe silverstripe/framework through 4.11 allows SQL Injection. CVSS 3.1HIGH 8.8
  • TI-2023-08903 Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen CVSS 3.1MEDIUM 6.1
  • TI-2022-18086 Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully… CVSS 3.1MEDIUM 6.1
  • TI-2022-18248 Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0… CVSS 3.1MEDIUM 5.4
  • TI-2022-08949 Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that… CVSS 3.1MEDIUM 5.4
  • TI-2022-17851 Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3). CVSS 3.1MEDIUM 5.4
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences