CVE-2017-10795: Subrion CMS Cross-site scripting (XSS) vulnerability
Summary
CVE-2017-10795: Subrion Cross-site scripting (XSS) vulnerability. Affects intelliants/subrion versions < 4.1.6. Fixed in 4.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Subrion CMS is an open-source content management system designed for creating and managing websites. It provides various features such as user management, content publishing, and template customization. The vulnerability identified as CVE-2017-10795 is a Cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML into the body of a blog post. This vulnerability affects Subrion CMS versions up to 4.1.5.
Vulnerability Detail
The Cross-site scripting (XSS) vulnerability in Subrion CMS allows attackers to exploit the system by injecting malicious web scripts or HTML code into the body of a blog post. This can lead to various security risks, including unauthorized access, data theft, and the execution of arbitrary code on the victim's browser. It is important to note that this vulnerability is different from CVE-2017-6069. The severity of this vulnerability is classified as MODERATE with a CVSS score of 6.1.
How To Fix
Minimum fixed version
4.1.6
This is the first release that contains the fix.
composer require intelliants/subrion:4.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to sanitize user input before displaying it on the website. This can be achieved by implementing input validation and output encoding techniques. Here is an example of how to sanitize user input in PHP:
$input = $_POST['input'];
$sanitizedInput = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
Conclusion
The CVE-2017-10795 vulnerability in Subrion CMS poses a moderate security risk due to the Cross-site scripting (XSS) vulnerability. It is crucial to update Subrion CMS to the latest version (4.1.6 or later) to mitigate this vulnerability. Implementing input validation and output encoding techniques can serve as a temporary workaround until the update is applied. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for intelliants/subrion →
FAQ
Subrion CMS is an open-source content management system used for creating and managing websites. It provides features such as user management, content publishing, and template customization.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts or HTML code into web pages viewed by other users. This can lead to various security risks, including data theft and unauthorized access.
The CVE-2017-10795 vulnerability in Subrion CMS allows remote attackers to inject arbitrary web script or HTML into the body of a blog post. This can potentially lead to unauthorized access, data theft, and the execution of malicious code on the victim's browser.
The severity of the CVE-2017-10795 vulnerability is classified as MODERATE with a CVSS score of 6.1.
To fix the CVE-2017-10795 vulnerability, it is recommended to update Subrion CMS to version 4.1.6 or later. The latest version includes a patch that addresses the XSS vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for intelliants/subrion.
