Subrion CMS XSS

2022-05-2417:17:57

Google

osv.dev

0.001 Low

EPSS

Percentile

50.1%

JSON

An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the v[language_switch] parameter (within multipart/form-data), which is reflected back within a user’s browser without proper output encoding.

CPENameOperatorVersion
intelliants/subrioneq4.0.2
intelliants/subrioneq4.1.5
intelliants/subrioneq4.0.5
intelliants/subrioneq4.1.3
intelliants/subrioneq4.1.1
intelliants/subrioneq4.2.0
intelliants/subrioneq4.2.1
intelliants/subrioneq4.1.2
intelliants/subrioneq4.0.1
intelliants/subrioneq4.0.0

Name	Operator	Version
intelliants/subrion	eq	4.0.2
intelliants/subrion	eq	4.1.5
intelliants/subrion	eq	4.0.5
intelliants/subrion	eq	4.1.3
intelliants/subrion	eq	4.1.1
intelliants/subrion	eq	4.2.0
intelliants/subrion	eq	4.2.1
intelliants/subrion	eq	4.1.2
intelliants/subrion	eq	4.0.1
intelliants/subrion	eq	4.0.0