PT-2018-13655 · Subrion · Subrion Cms

Publicado 2018-12-04 · Atualizado 2022-05-14 · CVE-2018-16629

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1

Description The issue allows for cross-site scripting (XSS) attacks via an SVG file containing JavaScript in a SCRIPT element, specifically affecting the "panel/uploads/#elf l1 XA" endpoint.

Recommendations For Subrion CMS version 4.2.1, consider disabling the "panel/uploads/#elf l1 XA" endpoint until a patch is available to prevent XSS attacks. Restrict access to uploading SVG files to minimize the risk of exploitation. Avoid using the panel/uploads/#elf l1 XA endpoint for uploading files that may contain JavaScript code in a SCRIPT element until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-16629

GHSA-MXV3-QCMF-R6WJ

Produtos afetados

Subrion Cms

Referências · 8

• 🔥❌ https://github.com/security-breachlock/CVE-2018-16629/blob/master/subrion_cms.pdf · Exploit, Deleted
• https://github.com/intelliants/subrion · Nota
• https://github.com/intelliants/subrion/commit/fbc29ddb29e9c9732695e25ad2c22e038eed6385 · Nota
• https://github.com/intelliants/subrion/issues/777 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16629 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16629 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16629 · Nota
• https://osv.dev/vulnerability/GHSA-mxv3-qcmf-r6wj · Aviso do Fabricante