PT-2022-11851 · Unknown · Subrion Cms

Published 2022-04-04 · Updated 2022-04-12 · CVE-2021-43464

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1

Description A Remote Code Execution (RCE) issue exists in Subrion CMS via modified code in a background field. When the information is modified, the data in it will be executed through eval(). This allows for potential code execution, posing a significant risk.

Recommendations For Subrion CMS version 4.2.1, consider disabling the background field functionality until a patch is available to prevent potential code execution through eval(). Additionally, restrict access to the background field to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2021-43464

GHSA-G54X-29XV-58H5

Affected Products

Subrion Cms

References · 6

• 🔥 https://github.com/intelliants/subrion/issues/888 · Exploit
• https://osv.dev/vulnerability/CVE-2021-43464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43464 · Security Note
• https://osv.dev/vulnerability/GHSA-g54x-29xv-58h5 · Vendor Advisory
• https://github.com/intelliants/subrion · Note
• https://t.me/cibsecurity/40114 · Telegram Post