CVE-2017-14498

SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add…

published September 15, 2017

CVSS
—
EPSS
1%
Percentile
70.3
In the wild
Unconfirmed
What it is

SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01304 · 70.3th percentile
Published
2017-09-15T18:00Z
EPSS history
Timeline
  • 15 SEP 18:00Z
    SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add…
    cvelistv5