PT-2022-26762 · Intelliants · Intelliants Subrion Cms

Sinemsahn · Published 2022-11-09 · Updated 2022-11-09 · CVE-2022-43120

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS version 4.2.1

Description A cross-site scripting (XSS) issue in the "/panel/fields/add" component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field default value text field.

Recommendations For Intelliants Subrion CMS version 4.2.1, consider disabling access to the "/panel/fields/add" component until a patch is available to prevent exploitation. Restrict the ability to inject crafted payloads into the Field default value text field to minimize risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-43120

GHSA-3WMG-28V9-8HF6

Affected Products

Intelliants Subrion Cms

References · 6

• 🔥 https://github.com/intelliants/subrion/issues/894 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-43120 · Security Note
• https://osv.dev/vulnerability/GHSA-3wmg-28v9-8hf6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43120 · Vendor Advisory
• https://github.com/intelliants/subrion · Note
• https://t.me/cvenotify/37412 · Telegram Post