PT-2018-12758 · Intelliants · Subrion Cms

Zeel Chavda · Publicado 2018-08-02 · Atualizado 2022-05-14 · CVE-2018-14840

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1

Description The issue in Subrion CMS allows for XSS due to the uploads/.htaccess file not blocking .html file uploads, while it does block other file types such as .htm.

Recommendations For Subrion CMS version 4.2.1, consider restricting or blocking .html file uploads in the uploads/.htaccess file as a temporary workaround until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-14840

GHSA-VHQR-3GR2-7PX9

Produtos afetados

Subrion Cms

Referências · 8

• 🔥 https://exploit-db.com/exploits/45150 · Exploit
• https://github.com/intelliants/subrion/commit/b12e287d3814c0f2d0b1892f95fc0190972d2ba5 · Nota
• https://github.com/intelliants/subrion/issues/773 · Nota
• https://github.com/intelliants/subrion/commit/cb10ac2294cb2c3a6d2159f9a2bb8c58a2a10a47 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-14840 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-14840 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vhqr-3gr2-7px9 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14840 · Nota