CVE-2017-9516

2017-06-0813:29:00

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.2%

JSON

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

CPENameOperatorVersion
cmseq1.0.2270
cmseq2.4.2698
cmseq2.6.2789
cmseq2.6.2903
cmseq1.3.2461
cmseq1.2.0-alpha.2322
cmseq0.9.0-alpha.2231
cmseq0.9.2094
cmseq2.6.2977
cmseq2.4.2692

Name	Operator	Version
cms	eq	1.0.2270
cms	eq	2.4.2698
cms	eq	2.6.2789
cms	eq	2.6.2903
cms	eq	1.3.2461
cms	eq	1.2.0-alpha.2322
cms	eq	0.9.0-alpha.2231
cms	eq	0.9.2094
cms	eq	2.6.2977
cms	eq	2.4.2692

Rows per page:

1-10 of 3881

References

craftcms.com/changelog#2-6-2982

packetstormsecurity.com/files/142851/Craft-CMS-2.6-Cross-Site-Scripting-File-Upload.html

twitter.com/CraftCMS/status/872599894912937984

www.exploit-db.com/exploits/42143/