CVE-2017-9516 Craft CMS XSS Vulnerability
MediumCVSS 5.4
EPSS 2.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| craftcms cms(Packagist) | < 2.6.2982 | 2.6.2982 |
| craftcms cms(Packagist) | = 1.0.26.1 | No fix listed |
| craftcms cms(Packagist) | = 1.2.0-alpha.2310 | No fix listed |
| craftcms cms(Packagist) | = 1.2.0-alpha.2312 | No fix listed |
| craftcms cms(Packagist) | = 1.2.0-alpha.2316 | No fix listed |
| craftcms cms(Packagist) | = 1.2.0-alpha.2318 | No fix listed |
| craftcms cms(Packagist) | = 1.2.0-alpha.2319 | No fix listed |
| craftcms cms(Packagist) | = 1.2.0-alpha.2322 | No fix listed |
| craftcms cms(Packagist) | = 1.2.0-alpha.2323 | No fix listed |
| craftcms cms(Packagist) | = 1.2.0-alpha.2324 | No fix listed |
| craftcms cms(Packagist) | = 1.2.0-alpha.2328 | No fix listed |
| craftcms cms(Packagist) | = 1.2.0-alpha.2329 | No fix listed |
| craftcms cms(Packagist) | = 1.2.0-alpha.2332 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2333 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2335 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2336 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2337 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2339 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2358 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2363 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2367 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2371 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2375 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2387 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2392 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| craftcms cms(Packagist) | = 1.2.2396 | No fix listed |
| craftcms cms(Packagist) | = 1.2.2399 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2361 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2366 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2372 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2374 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2377 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2378 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2380 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2388 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2394 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2397 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2401 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2402 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2405 | No fix listed |
| craftcms cms(Packagist) | = 1.3.0-alpha.2464 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2409 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2410 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2415 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2416 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2418 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2419 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2420 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2422 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2456 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2459 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2461 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2462 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2465 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2473 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2485 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2486 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2487 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2494 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2496 | No fix listed |
| craftcms cms(Packagist) | = 1.3.2507 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2469 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2470 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2471 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2476 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2478 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2479 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2482 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2484 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2488 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2489 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2490 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2491 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2492 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2493 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2495 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2497 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2498 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2499 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2500 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2502 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2503 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2505 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2506 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2509 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2512 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2513 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2519 | No fix listed |
| craftcms cms(Packagist) | = 1.4.0-alpha.2521 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2524 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2525 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2527 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2528 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2532 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2533 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2535 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2536 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2537 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2538 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2539 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2540 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2541 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2542 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2543 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2548 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2549 | No fix listed |
| craftcms cms(Packagist) | = 2.0.2551 | No fix listed |
| craftcms cms(Packagist) | = 2.1.0-alpha.2546 | No fix listed |
| craftcms cms(Packagist) | = 2.1.0-alpha.2547 | No fix listed |
| craftcms cms(Packagist) | = 2.1.0-alpha.2552 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2554 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2555 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2556 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2557 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2559 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2561 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2562 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2563 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2564 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2566 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2568 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2569 | No fix listed |
| craftcms cms(Packagist) | = 2.1.2570 | No fix listed |
| craftcms cms(Packagist) | = 2.2.0-alpha.2572 | No fix listed |
| craftcms cms(Packagist) | = 2.2.0-alpha.2575 | No fix listed |
| craftcms cms(Packagist) | = 2.2.0-alpha.2578 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2579 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2581 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2582 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2586 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2587 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2588 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2589 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2590 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2591 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2592 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2593 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2596 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2598 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2601 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2604 | No fix listed |
| craftcms cms(Packagist) | = 2.2.2607 | No fix listed |
| craftcms cms(Packagist) | = 2.3.0-alpha.2600 | No fix listed |
| craftcms cms(Packagist) | = 2.3.0-alpha.2602 | No fix listed |
| craftcms cms(Packagist) | = 2.3.0-alpha.2603 | No fix listed |
| craftcms cms(Packagist) | = 2.3.0-alpha.2605 | No fix listed |
| craftcms cms(Packagist) | = 2.3.0-alpha.2606 | No fix listed |
| craftcms cms(Packagist) | = 2.3.0-alpha.2608 | No fix listed |
| craftcms cms(Packagist) | = 2.3.0-alpha.2610 | No fix listed |
| craftcms cms(Packagist) | = 2.3.0-alpha.2612 | No fix listed |
| craftcms cms(Packagist) | = 2.3.0-alpha.2645 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2615 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2616 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2617 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2618 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2620 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2621 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2623 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2624 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2625 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2626 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2627 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2629 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2632 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2635 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2636 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2639 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2640 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2641 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2642 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2643 | No fix listed |
| craftcms cms(Packagist) | = 2.3.2644 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2664 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2666 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2667 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2668 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2669 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2670 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2675 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2677 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2679 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2682 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2684 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2688 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2691 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2692 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2693 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2695 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2696 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2697 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2698 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2699 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2700 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2701 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2702 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2723 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2725 | No fix listed |
| craftcms cms(Packagist) | = 2.4.2726 | No fix listed |
| craftcms cms(Packagist) | = 2.5.0-beta.2713 | No fix listed |
| craftcms cms(Packagist) | = 2.5.0-beta.2715 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- craftcms.com release-notes vendor-advisory
- github.com product
- packetstormsecurity.com exploit third-party-advisory
- twitter.com press-media-coverage third-party-advisory
- 42143 exploit
- github.com