CVE-2024-29885

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the `canView()` method for that report returns `false`. This issue has been addressed in version 5.2.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
silverstripe	silverstripe-reports	< 5.2.3

References

Timeline

Published: Jul 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-298865.3Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm t CVE-2024-298877.4Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all no CVE-2024-298885.4Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery me CVE-2024-298898.1GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability i CVE-2024-29898.8A vulnerability, which was classified as critical, has been found in Tenda FH1203 2.0.1.6. Affected by this issue is the function fromNatSta CVE-2024-298908.8DataLens is a business intelligence and data visualization system. A specifically crafted request allowed the creation of a special chart ty CVE-2024-298918.7ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML a CVE-2024-298924.9ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action cou CVE-2024-298936.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the Arg CVE-2024-298944.7Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scr CVE-2024-2989510.0Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows an CVE-2024-298967.5Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers ge