PT-2022-11515 · Unknown+1 · Subrion Cms+1

Onemanteam123321 · Published 2022-04-29 · Updated 2022-05-10 · CVE-2021-41948

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1 and earlier

Description A cross-site scripting (XSS) issue exists in the contact us plugin via the List of subjects. This can be exploited by someone with administrative privileges when they log in to the admin panel.

Recommendations For Subrion CMS version 4.2.1 and earlier, consider disabling the contact us plugin until a patch is available. Restrict access to the admin panel to minimize the risk of exploitation. Avoid using the List of subjects feature in the contact us plugin until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41948

GHSA-JV64-2M3X-6V4Q

Affected Products

Subrion Cms

Contacts

References · 6

• 🔥 https://github.com/intelliants/subrion-plugin-contact_us/issues/8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-41948 · Security Note
• https://osv.dev/vulnerability/GHSA-jv64-2m3x-6v4q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41948 · Vendor Advisory
• https://github.com/intelliants/subrion-plugin-contact_us · Note
• https://t.me/cibsecurity/41657 · Telegram Post