CVE-2024-47605

silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payload to be executed on both the CMS and the front-end of the website. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-79

• https://github.com/silverstripe/silverstripe-asset-admin/security/advisories/GHSA-7cmp-cgg8-4c82
• https://github.com/silverstripe/silverstripe-framework/commit/09b5052c86932f273e0d733428c9aade70ff2a4a
• https://www.silverstripe.org/download/security-releases/cve-2024-47605

Published

Jan 14, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4760A voltage glitch during the startup of EEFC NVM controllers …6.3
• CVE-2024-47600GStreamer is a library for constructing graphs of media-hand…9.1
• CVE-2024-47601GStreamer is a library for constructing graphs of media-hand…7.5
• CVE-2024-47602GStreamer is a library for constructing graphs of media-hand…7.5
• CVE-2024-47603GStreamer is a library for constructing graphs of media-hand…7.5
• CVE-2024-47604NuGet Gallery is a package repository that powers nuget.org.…6.1
• CVE-2024-47606GStreamer is a library for constructing graphs of media-hand…9.8
• CVE-2024-47607GStreamer is a library for constructing graphs of media-hand…9.8
• CVE-2024-47608Logicytics is designed to harvest and collect data for foren…9.8
• CVE-2024-47609Tonic is a native gRPC client & server implementation with a…6.9
• CVE-2024-4761Out of bounds write in V8 in Google Chrome prior to 124.0.63…8.8
• CVE-2024-47610InvenTree is an Open Source Inventory Management System. In …5.4