GitHub Advisoryadvisory · Packagist

GHSA-q4h5-g3w8-f9x7 Subrion CMS vulnerable to CSRF in admin/blocks/add

HIGH Published 2022-05-14 Modified 2023-10-10 Official page ↗

Aliases: CVE-2017-6068
Ecosystem: Packagist
Packages: intelliants/subrion
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-352
Reviewed: 2023-07-26

Affected packages

• Packagist intelliants/subrion: <= 4.0.5 (no fix yet)

Description

Subrion CMS 4.0.5 has CSRF in `admin/blocks/add/`. The attacker can create any block, and can optionally insert XSS via the content parameter.

Related

Alias · CVE (1)

CVE-2017-6068 Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. vulnerability

Weakness · CWE (1)

CWE-352 Cross-Site Request Forgery weakness

References