Описание
Silverstripe CMS XSS Vulnerability
SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2017-14498
- https://github.com/silverstripe/silverstripe-framework/commit/25b77a2ff8deabe8e8894002b9a5647eaec27b0a
- https://github.com/silverstripe/silverstripe-installer/commit/c25478bef75cc5482852e80a1fa6f1f0e6460e39
- https://docs.silverstripe.org/en/3/changelogs/3.6.1
- http://lists.openwall.net/full-disclosure/2017/09/14/2
Пакеты
Наименование
silverstripe/cms
composer
Затронутые версииВерсия исправления
< 3.6.1
3.6.1
Связанные уязвимости
CVSS3: 6.1
nvd
больше 8 лет назад
SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.