PT-2018-12758 · Intelliants · Subrion Cms

Zeel Chavda · Published 2018-08-02 · Updated 2022-05-14 · CVE-2018-14840

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1

Description The issue in Subrion CMS allows for XSS due to the uploads/.htaccess file not blocking .html file uploads, while it does block other file types such as .htm.

Recommendations For Subrion CMS version 4.2.1, consider restricting or blocking .html file uploads in the uploads/.htaccess file as a temporary workaround until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-14840

GHSA-VHQR-3GR2-7PX9

Affected Products

Subrion Cms

References · 8

• 🔥 https://exploit-db.com/exploits/45150 · Exploit
• https://github.com/intelliants/subrion/commit/cb10ac2294cb2c3a6d2159f9a2bb8c58a2a10a47 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-14840 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14840 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vhqr-3gr2-7px9 · Vendor Advisory
• https://github.com/intelliants/subrion/commit/b12e287d3814c0f2d0b1892f95fc0190972d2ba5 · Note
• https://github.com/intelliants/subrion/issues/773 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14840 · Note