CVE-2024-47605
Published: 14 January 2025
Summary
CVE-2024-47605 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Silverstripe (inferred from references). Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 8.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
silverstripe-asset-admin contains a cross-site scripting vulnerability in its insert-media workflow. When an oEmbed JSON response supplies an HTML attribute that replaces an embed shortcode, the supplied markup is inserted without sanitization, allowing script execution in both the CMS interface and the public site. The flaw affects the silverstripe-asset-admin component and is resolved in silverstripe/framework 5.3.8.
An unauthenticated remote attacker can supply a crafted oEmbed payload that is rendered when an editor inserts media or when the resulting page is viewed by any user. Successful exploitation yields execution of attacker-controlled JavaScript with the privileges of the victim’s session, enabling theft of CMS credentials or defacement of front-end content.
The GitHub advisory and Silverstripe security release recommend immediate upgrade to framework 5.3.8; no workarounds are documented. The associated EPSS score has remained flat at 0.0711 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-0081
Vulnerability details
silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a…
more
script payload to be executed on both the CMS and the front-end of the website. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.