PT-2017-16821 · Subrion · Subrion Cms

Published 2017-03-27 · Updated 2017-03-28 · CVE-2017-6002

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.0.5.10

Description The issue allows an attacker to perform a CSRF attack on the "admin/blog/add/" endpoint, enabling them to add any blog entry. Additionally, the attacker can insert XSS into the blog entry via the body parameter.

Recommendations For Subrion CMS version 4.0.5.10, consider implementing CSRF protection measures, such as token-based validation, to prevent unauthorized requests to the "admin/blog/add/" endpoint. As a temporary workaround, restrict access to this endpoint to minimize the risk of exploitation. Avoid using the body parameter in the affected endpoint until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-6002

Affected Products

Subrion Cms

References · 3

• https://osv.dev/vulnerability/CVE-2017-6002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6002 · Security Note
• http://yiwang6.cn/Subrion.docx · Note