PT-2017-16570 · Subrion · Subrion Cms

Xyntax · Publicado 2017-01-20 · Atualizado 2022-05-14 · CVE-2017-5543

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.0.5

Description The issue allows remote attackers to conduct PHP Object Injection attacks. This is achieved by sending crafted serialized data in a salt cookie within a login request to the includes/classes/ia.core.users.php file.

Recommendations For Subrion CMS version 4.0.5, as a temporary workaround, consider restricting access to the includes/classes/ia.core.users.php file until a patch is available. Avoid using the salt cookie in the affected login request until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2017-5543

GHSA-4J79-4M6Q-77VF

Produtos afetados

Subrion Cms

Referências · 8

• https://github.com/intelliants/subrion · Nota
• https://github.com/intelliants/subrion/commit/019dee20a38f39a5827aae2eb92f09b1f6afb7bb · Nota
• https://github.com/intelliants/subrion/issues/297 · Correção
• https://osv.dev/vulnerability/GHSA-4j79-4m6q-77vf · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5543 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5543 · Nota de Segurança
• http://securityfocus.com/bid/95688 · Nota
• https://osv.dev/vulnerability/CVE-2017-5543 · Aviso do Fabricante