GitHub Advisoryadvisory · Packagist

GHSA-j696-6m57-mcrv Silverstripe CMS XSS Vulnerability

MEDIUM Published 2022-05-17 Modified 2023-07-27 Official page ↗
Aliases
CVE-2017-14498
Ecosystem
Packagist
Packages
silverstripe/cms
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-27

Affected packages

• Packagist silverstripe/cms: < 3.6.1 → fixed in 3.6.1

Description

SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.

Related

Alias · CVE (1)

  • CVE-2017-14498 SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References