Cross-Site Scripting Vulnerability in Subrion CMS by Subrion
CVE-2019-20389

6.1MEDIUM

Key Information:

Vendor

Intelliants

Status
Subrion
Vendor
CVE Published:
15 May 2020

What is CVE-2019-20389?

An XSS vulnerability exists in Subrion CMS 4.2.1 that allows remote attackers to inject arbitrary JavaScript code through the v[language_switch] parameter in multipart/form-data requests. This injected code is reflected back to the user's browser, enabling potential exploitation and unauthorized actions. Proper output encoding is necessary to mitigate this security risk, as the vulnerability can lead to compromised user sessions and manipulation of web content.

References

http://packetstormsecurity.com/files/157699/Subrion-CMS-4...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.