CVE-2017-15284

Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the…

published October 12, 2017

CVSS
—
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04027 · 90.5th percentile
Published
2017-10-12T08:00Z
EPSS history
Timeline
  • 12 OCT 08:00Z
    Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the…
    cvelistv5