Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-32981
CVE-2024-32981:
PHP vulnerability analysis and mitigation
Overview
Silverstripe framework, the PHP framework forming the base for the Silverstripe CMS, was found to contain a Cross-Site Scripting (XSS) vulnerability (CVE-2024-32981). In affected versions prior to 5.2.16, a malicious actor with CMS content editing access could send a specifically crafted encoded payload to the server, which could be used to inject JavaScript code on the front end of the site. The vulnerability was discovered and disclosed on July 17, 2024 (Silverstripe Advisory).
Technical details
The vulnerability stems from insufficient server-side sanitization of data attributes. While client-side sanitization was in place, the server-side sanitization logic failed to catch specifically crafted encoded payloads. The issue has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating network accessibility, low attack complexity, and required low privileges (GitHub Advisory).
Impact
The vulnerability allows authenticated users with CMS content editing permissions to execute JavaScript code both in the CMS environment and on the front-end of the website. This could potentially lead to unauthorized data access and manipulation of website content (Silverstripe Advisory).
Mitigation and workarounds
The vulnerability has been patched in Silverstripe framework version 5.2.16. All users are advised to upgrade to this version as there are no known workarounds for this vulnerability (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management