What is GHSA-vhqr-3gr2-7px9?

GHSA-vhqr-3gr2-7px9 is a security advisory published by GitHub Security Advisories with Medium severity. Subrion CMS Cross-site Scripting

Which CVE IDs does GHSA-vhqr-3gr2-7px9 cover?

GHSA-vhqr-3gr2-7px9 covers the following CVE IDs: CVE-2018-14840. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vhqr-3gr2-7px9?

GHSA-vhqr-3gr2-7px9 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-vhqr-3gr2-7px9?

GHSA-vhqr-3gr2-7px9 affects 1 product, including: composer/intelliants/subrion:\u003c 4.2.2.

GHSA-vhqr-3gr2-7px9MediumCVSS 6.1

Subrion CMS Cross-site Scripting

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

September 21, 2023

🔗 CVE IDs covered (1)

CVE-2018-14840 →

📋 Description

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).

🎯 Affected products1

composer/intelliants/subrion:< 4.2.2

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2018-14840
https://github.com/intelliants/subrion/issues/773
https://github.com/intelliants/subrion/commit/cb10ac2294cb2c3a6d2159f9a2bb8c58a2a10a47
https://www.exploit-db.com/exploits/45150/
https://github.com/intelliants/subrion/commit/b12e287d3814c0f2d0b1892f95fc0190972d2ba5
https://github.com/advisories/GHSA-vhqr-3gr2-7px9