CVE-2024-53277

Cross-site Scripting in form messages in silverstripe framework

Description

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In some cases, form messages can contain HTML markup. This is an intentional feature, allowing links and other relevant HTML markup for the given message. Some form messages include content that the user can provide. There are scenarios in the CMS where that content doesn't get correctly sanitised prior to being included in the form message, resulting in an XSS vulnerability. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Category

5.4
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.07%
Affected: silverstripe silverstripe-framework
Published at:
Updated at:

References

Link Tags
https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-ff6q-3c9c-6cf5
https://github.com/silverstripe/silverstripe-framework/commit/74904f539347b7d1f8c5b5fb9e28d62ff251ee00
https://www.silverstripe.org/download/security-releases/cve-2024-53277

Frequently Asked Questions

What is the severity of CVE-2024-53277?
CVE-2024-53277 has been scored as a medium severity vulnerability.
How to fix CVE-2024-53277?
To fix CVE-2024-53277, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-53277 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-53277 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-53277?
CVE-2024-53277 affects silverstripe silverstripe-framework.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.