Lucene search

GitHub Advisory DatabaseGHSA-Q832-2275-RFQH

HistorySep 27, 2023 - 3:30 p.m.

Subrion CMS XSS in /panel/configuration/financial/

2023-09-2715:30:38

CWE-79

GitHub Advisory Database

github.com

cross-site scripting

subrion v4.2.1

arbitrary web scripts

html

crafted payload

minimum deposit

maximum balance

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

14.1%

JSON

A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: ‘Minimum deposit’, ‘Maximum deposit’ and/or ‘Maximum balance’.

Affected configurations

Vulners

Node

intelliantssubrionRange≤4.2.1

CPENameOperatorVersion
intelliants/subrionle4.2.1

CPE	Name	Operator	Version
	intelliants/subrion	le	4.2.1

References

github.com/advisories/GHSA-q832-2275-rfqh

github.com/al3zx/xss_financial_subrion_4.2.1

nvd.nist.gov/vuln/detail/CVE-2023-43830