PT-2017-13842 · Intelliants · Subrion Cms

9Emin1 · Published 2017-10-06 · Updated 2022-05-14 · CVE-2017-15063

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Subrion CMS versions 4.1.x through 4.1.5 Subrion CMS versions before 4.2.0

Description The issue arises from a logic error in the code, specifically in the ia.core.php file, where the CSRF detection functionality is called too late. This allows for potential attacks, such as those targeting the query parameter in the "panel/database" endpoint.

Recommendations For Subrion CMS versions 4.1.x through 4.1.5, update to version 4.2.0 or later to resolve the issue. For Subrion CMS versions before 4.2.0, update to version 4.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the ia.core.php code and the "panel/database" endpoint to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-15063

GHSA-RC94-7V55-WMG6

Affected Products

Subrion Cms

References · 8

• https://github.com/intelliants/subrion/issues/547 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15063 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15063 · Security Note
• https://osv.dev/vulnerability/GHSA-rc94-7v55-wmg6 · Vendor Advisory
• https://github.com/intelliants/subrion/commit/65fb937a588d730e57da0c2c5ca3bc4b9c2b5628 · Note
• https://github.com/intelliants/subrion/issues/570 · Note
• https://github.com/intelliants/subrion/commit/5fdf03af1a7d89c3692faa155e17457153020dca · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15063 · Note