4.8med
CVE-2017-15948
Perch Content Management System 3.0.3 allows unrestricted file upload (with resultant XSS) via the Asset Title field in conjunction with th…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
4.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 48%
Public exploits
0
none known
Summary
Perch Content Management System 3.0.3 allows unrestricted file upload (with resultant XSS) via the Asset Title field in conjunction with the Select File field. This is exploitable with a Limited Admin account.
Exploit prediction (EPSS)
0.59% probability of exploitation in the next 30 days, higher than 48% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- vulnerability-lab.com /get_content.php?id=2067 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-15948
- NVD: CVE-2017-15948
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.