| Package | Affected versions | Patched versions |
|---|---|---|
| silverstripe/cms | < 3.6.1 | 3.6.1 |
| silverstripe | ≤ 3.6.0 |
SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free