Lucene search

GoogleOSV:GHSA-Q832-2275-RFQH

HistorySep 27, 2023 - 3:30 p.m.

Subrion CMS XSS in /panel/configuration/financial/

2023-09-2715:30:38

Google

osv.dev

subrion

xss

financial configuration

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.0004 Low

EPSS

Percentile

14.1%

JSON

A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: ‘Minimum deposit’, ‘Maximum deposit’ and/or ‘Maximum balance’.

CPENameOperatorVersion
intelliants/subrioneq4.1.0
intelliants/subrioneq4.2.0
intelliants/subrioneq4.0.4
intelliants/subrioneq4.2.1
intelliants/subrioneq4.1.2
intelliants/subrioneq4.1.5
intelliants/subrioneq4.0.2
intelliants/subrioneq4.1.3
intelliants/subrioneq4.0.5
intelliants/subrioneq4.1.1

Name	Operator	Version
intelliants/subrion	eq	4.1.0
intelliants/subrion	eq	4.2.0
intelliants/subrion	eq	4.0.4
intelliants/subrion	eq	4.2.1
intelliants/subrion	eq	4.1.2
intelliants/subrion	eq	4.1.5
intelliants/subrion	eq	4.0.2
intelliants/subrion	eq	4.1.3
intelliants/subrion	eq	4.0.5
intelliants/subrion	eq	4.1.1

Rows per page:

1-10 of 141

References

github.com/al3zx/xss_financial_subrion_4.2.1

github.com/intelliants/subrion

nvd.nist.gov/vuln/detail/CVE-2023-43830