PT-2017-16821 · Subrion · Subrion Cms

Publicado 2017-03-27 · Atualizado 2017-03-28 · CVE-2017-6002

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.0.5.10

Description The issue allows an attacker to perform a CSRF attack on the "admin/blog/add/" endpoint, enabling them to add any blog entry. Additionally, the attacker can insert XSS into the blog entry via the body parameter.

Recommendations For Subrion CMS version 4.0.5.10, consider implementing CSRF protection measures, such as token-based validation, to prevent unauthorized requests to the "admin/blog/add/" endpoint. As a temporary workaround, restrict access to this endpoint to minimize the risk of exploitation. Avoid using the body parameter in the affected endpoint until the issue is resolved.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-6002

Produtos afetados

Subrion Cms

Referências · 3

• http://yiwang6.cn/Subrion.docx · Nota
• https://osv.dev/vulnerability/CVE-2017-6002 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6002 · Nota de Segurança