What is GHSA-mxv3-qcmf-r6wj?

GHSA-mxv3-qcmf-r6wj is a security advisory published by GitHub Security Advisories with Medium severity. Subrion CMS XSS

Which CVE IDs does GHSA-mxv3-qcmf-r6wj cover?

GHSA-mxv3-qcmf-r6wj covers the following CVE IDs: CVE-2018-16629. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mxv3-qcmf-r6wj?

GHSA-mxv3-qcmf-r6wj has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mxv3-qcmf-r6wj?

GHSA-mxv3-qcmf-r6wj affects 1 product, including: composer/intelliants/subrion:\u003c= 4.2.1.

GHSA-mxv3-qcmf-r6wjMediumCVSS 4.8

Subrion CMS XSS

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

October 6, 2023

🔗 CVE IDs covered (1)

CVE-2018-16629 →

📋 Description

panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.

🎯 Affected products1

composer/intelliants/subrion:<= 4.2.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-16629
https://github.com/security-breachlock/CVE-2018-16629/blob/master/subrion_cms.pdf
https://github.com/intelliants/subrion/issues/777
https://github.com/intelliants/subrion/commit/fbc29ddb29e9c9732695e25ad2c22e038eed6385
https://github.com/advisories/GHSA-mxv3-qcmf-r6wj