CSRF Vulnerabilities in Subrion CMS by Intelliants
CVE-2017-15063

8.8HIGH

Key Information:

Vendor

Intelliants

Status
Subrion
Vendor
CVE Published:
6 October 2017

What is CVE-2017-15063?

Subrion CMS contains a Cross-Site Request Forgery (CSRF) vulnerability due to a logic error in its core functionality. The CSRF detection mechanism in the 'ia.core.php' file is invoked too late, which could allow attackers to exploit the query parameter to perform unauthorized actions within the system. This flaw affects versions 4.1.x through 4.1.5 and prior to 4.2.0, posing risks to user data integrity and overall site security.

References

https://github.com/intelliants/subrion/issues/570
x_refsource_MISC
https://github.com/intelliants/subrion/issues/547
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.