CSV Injection in Subrion CMS 4.2.1 by Belong2Yourself
CVE-2020-12468

7.8HIGH

Key Information:

Vendor

Intelliants

Status
Subrion
Vendor
CVE Published:
29 April 2020

What is CVE-2020-12468?

Subrion CMS version 4.2.1 is susceptible to a CSV injection vulnerability, where an attacker can manipulate the application by injecting malicious phrases within language settings. This can lead to potential exploitation through exported CSV files, allowing attackers to execute harmful commands when the files are opened. Users of this CMS should be aware of this risk, particularly in contexts where CSV files are handled.

References

https://github.com/belong2yourself/vulnerabilities/tree/m...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.