GitHub Advisoryadvisory · Packagist

GHSA-g8j7-w673-4mjp Subrion CMS CSRF Vulnerability

HIGH Published 2022-05-24 Modified 2023-10-05 Official page ↗

Aliases: CVE-2018-21037
Ecosystem: Packagist
Packages: intelliants/subrion
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-352
Reviewed: 2023-07-20

Affected packages

• Packagist intelliants/subrion: < 4.2.1 → fixed in 4.2.1

Description

Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the `panel/members/edit/1` URI.

Related

Alias · CVE (1)

CVE-2018-21037 Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI. vulnerability

Weakness · CWE (1)

CWE-352 Cross-Site Request Forgery weakness

References