Cross-Site Scripting Vulnerability in Subrion CMS 4.2.1
CVE-2019-7356

5.4MEDIUM

Key Information:

Vendor

Intelliants

Status
Subrion
Vendor
CVE Published:
4 November 2020

Badges

👾 Exploit Exists

What is CVE-2019-7356?

Subrion CMS version 4.2.1 is susceptible to a cross-site scripting (XSS) vulnerability, which can be exploited through the panel/phrases/ VALUE parameter. This flaw allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking, data theft, or unauthorized actions on behalf of the users. It is critical for users and administrators of Subrion CMS to apply the necessary updates and implement proper validation measures to mitigate this security risk.

References

https://github.com/intelliants/subrion/commits/develop
x_refsource_MISC
https://github.com/ngpentest007/CVE-2019-7356/blob/main/S...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.