Silverstripe: >> Silverstripe >> 3.6.0 Security Vulnerabilities
Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.
CVSS Score
5.3
EPSS Score
0.002
Published
2017-10-12
SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.
CVSS Score
6.1
EPSS Score
0.004
Published
2017-09-15
Page 3