CVE-2024-32981

Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS could add send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it. The server-side sanitisation logic has been updated to sanitise against this type of attack in version 5.2.16. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-79

• https://github.com/silverstripe/silverstripe-framework/commit/b8d20dc9d531550e06fd7da7a0eafa551922e2e1Patch
• https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-chx7-9x8h-r5mgThird Party Advisory
• https://www.silverstripe.org/download/security-releases/cve-2024-32981Vendor Advisory
• https://github.com/silverstripe/silverstripe-framework/commit/b8d20dc9d531550e06fd7da7a0eafa551922e2e1Patch
• https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-chx7-9x8h-r5mgThird Party Advisory
• https://www.silverstripe.org/download/security-releases/cve-2024-32981Vendor Advisory

Published

Jul 17, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32976Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-32977OctoPrint provides a web interface for controlling consumer …9.4
• CVE-2024-32978Kaminari is a paginator for web app frameworks and object re…6.6
• CVE-2024-32979Nautobot is a Network Source of Truth and Network Automation…6.1
• CVE-2024-3298Out-Of-Bounds Write and Type Confusion vulnerabilities exist…7.8
• CVE-2024-32980Spin is the developer tool for building and running serverle…9.1
• CVE-2024-32982Litestar and Starlite is an Asynchronous Server Gateway Inte…8.2
• CVE-2024-32983Misskey is an open source, decentralized microblogging platf…7.5
• CVE-2024-32984Yamux is a stream multiplexer over reliable, ordered connect…7.5
• CVE-2024-32985Stellar-core is a reference implementation for the peer-to-p…5.9
• CVE-2024-32986PWAsForFirefox is a tool to install, manage and use Progress…9.6
• CVE-2024-32987Microsoft SharePoint Server Information Disclosure Vulnerabi…7.5