Cross-Site Scripting Vulnerability in Silverstripe Framework by Silverstripe

CVE-2024-53277

What is CVE-2024-53277?

The Silverstripe Framework, utilized in the Silverstripe CMS, includes an aspect where form messages can display HTML markup intentionally, facilitating links and relevant content. However, certain scenarios arise where user-inputted content is inadequately sanitized before being rendered within these form messages, exposing a Cross-Site Scripting (XSS) vulnerability. This flaw has been rectified in version 5.3.8. Users are strongly encouraged to upgrade to this version to ensure their applications remain secure, as there are no known workarounds for this vulnerability.

References