Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

CVE-2024-53277 XSS in form messages

CVE-2024-53277 XSS in form messages

Severity:
Medium (?)
Identifier:
CVE-2024-53277
Versions Affected:
silverstripe/framework: <5.3.8
Versions Fixed:
silverstripe/framework: 5.3.8
Release Date:
2025-01-15

In some cases, form messages can contain HTML markup. This is an intentional feature, allowing links and other relevant HTML markup for the given message.

Some form messages include content that the user can provide. There are scenarios in the CMS where that content doesn't get correctly sanitised prior to being included in the form message, resulting in an XSS vulnerability.

Base CVSS: 5.4
Reported by: Leo Diamat from Bastion Security Group