CVE-2017-15948

Perch Content Management System 3.0.3 allows unrestricted file upload (with resultant XSS) via the Asset Title field in conjunction with the Select File field. This is exploitable with a Limited Admin account.

Score

CVSS 3.1 4.8 Medium

Status

Modified - cve@mitre.org

Published

2017-10-28

Last modified

2024-09-16

Weaknesses

CWE-79

Affected products

• Perch (Grabaperch)

References

• https://www.vulnerability-lab.com/get_content.php?id=2067