CVSS 3.0
6.1 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2017-14498
Medium (6.1) in silverstripe silverstripe. EPSS 1.3% chance of exploitation in the next 30 days.
SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- silverstripe:silverstripe
References
- http://lists.openwall.net/full-disclosure/2017/09/14/2
- https://docs.silverstripe.org/en/3/changelogs/3.6.1
- https://github.com/silverstripe/silverstripe-framework/commit/25b77a2ff8deabe8e8894002b9a5647eaec27b0a
- https://github.com/silverstripe/silverstripe-installer/commit/c25478bef75cc5482852e80a1fa6f1f0e6460e39
- http://lists.openwall.net/full-disclosure/2017/09/14/2