PT-2017-16570 · Subrion · Subrion Cms

Xyntax · Published 2017-01-20 · Updated 2022-05-14 · CVE-2017-5543

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.0.5

Description The issue allows remote attackers to conduct PHP Object Injection attacks. This is achieved by sending crafted serialized data in a salt cookie within a login request to the includes/classes/ia.core.users.php file.

Recommendations For Subrion CMS version 4.0.5, as a temporary workaround, consider restricting access to the includes/classes/ia.core.users.php file until a patch is available. Avoid using the salt cookie in the affected login request until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2017-5543

GHSA-4J79-4M6Q-77VF

Affected Products

Subrion Cms

References · 8

• https://github.com/intelliants/subrion/issues/297 · Patch
• https://osv.dev/vulnerability/GHSA-4j79-4m6q-77vf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5543 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5543 · Vendor Advisory
• https://github.com/intelliants/subrion · Note
• https://github.com/intelliants/subrion/commit/019dee20a38f39a5827aae2eb92f09b1f6afb7bb · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5543 · Note
• http://securityfocus.com/bid/95688 · Note