CVE-2024-29885 json
Reports are still accessible even when `canView()` returns false in silverstripe/reports
published 2024-07-17 2 y ago modified 2026-09-10 1 mo ago also GHSA-89q6-98xx-4ffw , EUVD-2024-2294
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the `canView()` method for that report returns `false`. This issue has been addressed in version 5.2.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- packagist silverstripe/reports 5.2.3
- silverstripe reports 5.2.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | silverstripe/reports | <5.2.3 |
5.2.3 |
Affected products
- silverstripe silverstripe-reports
Classification
References
-
github.com
/silverstripe/silverstripe-reports/commit/0351106c18ad4246d983b5f4e082c09c382121f4
web, patch
-
github.com
/silverstripe/silverstripe-reports/security/advisories/GHSA-89q6-98xx-4ffw
web, vendor-advisory
-
silverstripe.org
/download/security-releases/cve-2024-29885
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-29885
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/silverstripe/reports/CVE-2024-29885.yaml
web
-
github.com
/silverstripe/silverstripe-reports
package
Sources
- CVE List CVE-2024-29885
- GitHub Advisory GHSA-89q6-98xx-4ffw
- NVD CVE-2024-29885
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.