TI-2024-35739 Aliases CVE-2024-53277 GHSA-ff6q-3c9c-6cf5

Cross-site Scripting in form messages in silverstripe framework

LOW 24CWE-79Published 2025-01-14 · Updated 2025-01-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In some cases, form messages can contain HTML markup. This is an intentional feature, allowing links and other relevant HTML markup for the given message. Some form messages include content that the user can provide. There are scenarios in the CMS where that content doesn't get correctly sanitised prior to being included in the form message, resulting in an XSS vulnerability. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00326 25th percentileScored 2026-11-07

Fix Fixed silverstripe-framework (silverstripe): 5.3.8silverstripe/framework (Packagist): 5.3.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
silverstripe	silverstripe-framework	before 5.3.8	5.3.8	Patch available	CNA
—	silverstripe/framework (Packagist)	before 5.3.8	5.3.8	Patch available	GHSA-ff6q-3c9c-6cf5

silverstripe-framework Vendorsilverstripe Affected before 5.3.8 Fixed in 5.3.8 Patch available CNA
silverstripe/framework (Packagist) Vendor— Affected before 5.3.8 Fixed in 5.3.8 Patch available GHSA-ff6q-3c9c-6cf5

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:silverstripe:framework::::::::	before 5.3.8	Vulnerable	silverstripe

cpe:2.3:a:silverstripe:framework:*:*:*:*:*:*:*:* Versions before 5.3.8 Vulnerable ·silverstripe

Remediation

Fix · CNA silverstripe-framework (silverstripe) Fixed in 5.3.8
Fix · GHSA-ff6q-3c9c-6cf5 silverstripe/framework (Packagist) Fixed in 5.3.8 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-53277
2026-10-03 Alias added: GHSA-ff6q-3c9c-6cf5

References

Patch 1

https://github.com/silverstripe/silverstripe-framework/commit/74904f539347b7d1f8c5b5fb9e28d62ff251ee00

Advisory 3

Other 2

TI-2022-17852 Silverstripe silverstripe/framework through 4.11 allows SQL Injection. CVSS 3.1HIGH 8.8
TI-2023-08903 Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen CVSS 3.1MEDIUM 6.1
TI-2022-18086 Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully… CVSS 3.1MEDIUM 6.1
TI-2022-18248 Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0… CVSS 3.1MEDIUM 5.4
TI-2022-08949 Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that… CVSS 3.1MEDIUM 5.4
TI-2022-17851 Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3). CVSS 3.1MEDIUM 5.4

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences