CVE-2024-47605

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payload to be executed on both the CMS and the front-end of the website. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 14, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-476069.8GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_CVE-2024-476079.8GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_pa CVE-2024-476089.8Logicytics is designed to harvest and collect data for forensic analysis. Logicytics has a basic vuln affecting compromised devices from she CVE-2024-476096.9Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS at CVE-2024-47618.8Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a CVE-2024-476105.4InvenTree is an Open Source Inventory Management System. In affected versions of InvenTree it is possible for a registered user to store jav CVE-2024-476116.3XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows (MinGW-w64 or MSVC), the CVE-2024-476123.5DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table CVE-2024-476139.8GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in CVE-2024-476147.5async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a fie CVE-2024-476159.8GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis CVE-2024-476166.8Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium