GitHub Advisoryadvisory · Packagist

GHSA-c939-g732-48r8 Subrion CMS vulnerable to CSRF in blog/delete

HIGH Published 2022-05-14 Modified 2023-10-10 Official page ↗

Aliases: CVE-2017-18366
Ecosystem: Packagist
Packages: intelliants/subrion
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-352
Reviewed: 2023-07-26

Affected packages

• Packagist intelliants/subrion: < 4.2.1 → fixed in 4.2.1

Description

Subrion CMS is vulnerable to cross-site request forgery in `blog/delete/`. This has been patched in version 4.2.1.

Related

Alias · CVE (1)

CVE-2017-18366 Subrion CMS 4.1.5 has CSRF in blog/delete/. vulnerability

Weakness · CWE (1)

CWE-352 Cross-Site Request Forgery weakness

References