CVE-2020-12468: Subrion CMS CSV Injection via Export Language
Summary
CVE-2020-12468: Subrion CMS CSV injection via Export Language. Affects intelliants/subrion versions 4.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Subrion CMS is a content management system that allows users to create and manage websites. It provides various features such as user management, content editing, and language localization. The vulnerability identified as CVE-2020-12468 affects Subrion CMS version 4.2.1. This vulnerability allows for CSV injection through a phrase value within a language. Specifically, it is related to the 'phrases/add/' and 'languages/download/' functionalities.
Vulnerability Detail
The vulnerability in Subrion CMS 4.2.1 arises from insufficient input validation and sanitization of the phrase value within a language. An attacker can exploit this vulnerability by injecting malicious code into the phrase value, which will be executed when the CSV file is opened or processed. This can lead to various consequences, including data manipulation, unauthorized access, or remote code execution. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually inspect and sanitize the phrase values within the language files. This can be done by removing any potentially malicious code or characters that could trigger CSV injection. However, this workaround is not recommended as it may be time-consuming and prone to human error. It is strongly advised to apply the official patch or update the software.
Conclusion
The vulnerability identified as CVE-2020-12468 in Subrion CMS 4.2.1 allows for CSV injection via a phrase value within a language. This can lead to various consequences, including data manipulation, unauthorized access, or remote code execution. It is crucial for users of Subrion CMS to update their installations to the latest patched version and ensure that all language files are updated. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for intelliants/subrion →
FAQ
Subrion CMS is a content management system that allows users to create and manage websites. It provides various features such as user management, content editing, and language localization.
CSV injection is a technique where an attacker injects malicious code into a CSV file. When the file is opened or processed, the injected code can be executed, leading to various consequences such as data manipulation or remote code execution.
This vulnerability can be exploited by injecting malicious code into the phrase value within a language in Subrion CMS. When the CSV file is opened or processed, the injected code will be executed.
The potential consequences of this vulnerability include data manipulation, unauthorized access, or remote code execution. An attacker can exploit this vulnerability to perform malicious actions on the affected Subrion CMS installation.
Yes, the Subrion CMS development team has released a security update addressing this vulnerability. Users are advised to upgrade to the latest patched version of Subrion CMS and ensure that all language files are updated as well.
Related vulnerabilities
Recent vulnerabilities recorded for intelliants/subrion.
