Cross-Site Request Forgery in Subrion CMS Allowing Tag Manipulation
CVE-2017-6069

8.8HIGH

Key Information:

Vendor

Intelliants

Status
Subrion Cms
Vendor
CVE Published:
27 March 2017

What is CVE-2017-6069?

Subrion CMS version 4.0.5 is vulnerable to Cross-Site Request Forgery (CSRF) in the admin/blog/add/ endpoint. This vulnerability allows an attacker to add arbitrary tags to blog posts without any user authentication. Additionally, an attacker could exploit the tags parameter to inject malicious scripts, leading to potential Cross-Site Scripting (XSS) attacks. Proper input validation and security measures are crucial to mitigate this risk.

References

https://www.yiwang6.cn/Subrion-CSRF2.docx
x_refsource_MISC
http://www.securityfocus.com/bid/97196
vdb-entryx_refsource_BID

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.