CVE-2017-14498

Published: 2017-09-15T18:29Z

Last Modified: 2024-11-21T03:12Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt