PT-2018-12754 · Subrion · Subrion

Rishaldwivedi · Published 2018-08-02 · Updated 2019-10-03 · CVE-2018-14836

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Subrion version 4.2.1

Description The issue allows user groups without access to the Admin panel to access it, although they cannot perform actions, if the Guests user group has access to the Admin panel. This is due to improper access control.

Recommendations For Subrion version 4.2.1, consider restricting access to the Admin panel for the Guests user group to prevent unauthorized access.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2018-14836

Affected Products

Subrion

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-14836 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14836 · Vendor Advisory
• https://github.com/intelliants/subrion/issues/762 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14836 · Note