PT-2017-13842 · Intelliants · Subrion Cms

9Emin1 · Publicado 2017-10-06 · Atualizado 2022-05-14 · CVE-2017-15063

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Subrion CMS versions 4.1.x through 4.1.5 Subrion CMS versions before 4.2.0

Description The issue arises from a logic error in the code, specifically in the ia.core.php file, where the CSRF detection functionality is called too late. This allows for potential attacks, such as those targeting the query parameter in the "panel/database" endpoint.

Recommendations For Subrion CMS versions 4.1.x through 4.1.5, update to version 4.2.0 or later to resolve the issue. For Subrion CMS versions before 4.2.0, update to version 4.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the ia.core.php code and the "panel/database" endpoint to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-15063

GHSA-RC94-7V55-WMG6

Produtos afetados

Subrion Cms

Referências · 8

• https://github.com/intelliants/subrion/issues/547 · Aviso do Fabricante
• https://github.com/intelliants/subrion/commit/65fb937a588d730e57da0c2c5ca3bc4b9c2b5628 · Nota
• https://github.com/intelliants/subrion/issues/570 · Nota
• https://github.com/intelliants/subrion/commit/5fdf03af1a7d89c3692faa155e17457153020dca · Nota
• https://osv.dev/vulnerability/CVE-2017-15063 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15063 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15063 · Nota
• https://osv.dev/vulnerability/GHSA-rc94-7v55-wmg6 · Aviso do Fabricante