CVE-2024-29885
Reports are still accessible even when `canView()` returns false in silverstripe/reports
silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView() method for that report returns false. This issue has been addressed in version 5.2.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Reports are still accessible even when `canView()` returns false in silverstripe/reports
silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView() method for that report returns false. This issue has been addressed in version 5.2.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-29885- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2024-2294
silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView() method for that report returns false. This issue has been addressed in version 5.2.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2024-2294- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-89q6-98xx-4ffw
Silverstripe Reports are still accessible even when `canView()` returns false
Reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView() method for that report returns false.
References
- Record
GHSA-89q6-98xx-4ffw- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-863
- Updated
- 2026-11-02
NVD
silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView() method for that report returns false. This issue has been addressed in version 5.2.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-29885- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Reports are still accessible even when `canView()` returns false in silverstripe/reports
silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView() method for that report returns false. This issue has been addressed in version 5.2.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-29885- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-89q6-98xx-4ffw
Silverstripe Reports are still accessible even when `canView()` returns false
Reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView() method for that report returns false.
References
- Record
GHSA-89q6-98xx-4ffw- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-863
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/reportsPackagist |
before 5.2.3 | 5.2.3 |
silverstripe/reportsPackagist |
before 5.2.3, plus listed versions 1.1.03.2.03.2.0-beta13.2.0-beta23.2.0-rc1 Show 45 moreShow less3.2.0-rc23.2.13.2.1-rc13.2.1-rc23.2.23.2.2-rc13.2.2-rc23.2.33.2.3-rc13.2.3-rc23.2.43.2.4-rc13.2.53.2.5-rc13.2.5-rc23.2.63.3.03.3.0-beta13.3.0-rc13.3.0-rc23.3.0-rc33.3.13.3.1-rc13.3.1-rc23.3.23.3.2-rc13.3.33.3.3-rc13.3.3-rc23.3.43.4.03.4.0-rc13.4.13.4.1-rc13.4.1-rc23.4.23.4.33.4.3-rc13.4.43.4.4-rc13.4.53.4.5-rc13.4.63.4.6-rc13.4.6-rc2 |
5.2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-29885 is a medium vulnerability (CVSS 4.3) in Silverstripe Reports, published July 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in silverstripe/reports 5.2.3.
References
github.com/silverstripe/silverstripe-reports/security/advisories/GHSA-89q6-98xx-4ffw
silverstripe.org/download/security-releases/cve-2024-29885
nvd.nist.gov/vuln/detail/CVE-2024-29885
Left out here: 140 versions. The JSON record has them.