Publish Advisories

GHSA-2xv7-fwh6-x7fc
GHSA-4f4h-jgjp-3vfg
GHSA-4j79-4m6q-77vf
GHSA-6wc4-v4v5-3m82
GHSA-9738-c49q-4rgc
GHSA-c4wx-3x5q-hf4w
GHSA-fmqq-hw9m-448q
GHSA-jj94-j4r3-5gr4
GHSA-xhc3-5pgf-p576
GHSA-2xv7-fwh6-x7fc
GHSA-4j79-4m6q-77vf
GHSA-6wc4-v4v5-3m82
GHSA-fmqq-hw9m-448q
GHSA-jj94-j4r3-5gr4
This commit is contained in:
advisory-database[bot]
2024-04-25 21:55:22 +00:00
parent 8ed481d188
commit 7b227a4935
14 changed files with 439 additions and 214 deletions
@@ -0,0 +1,68 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2xv7-fwh6-x7fc",
"modified": "2024-04-25T21:53:56Z",
"published": "2022-05-14T02:01:19Z",
"aliases": [
"CVE-2017-10795"
],
"summary": "Subrion Cross-site scripting (XSS) vulnerability",
"details": "Cross-site scripting (XSS) vulnerability in Subrion CMS allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "intelliants/subrion"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.6"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.1.5"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10795"
},
{
"type": "WEB",
"url": "https://github.com/intelliants/subrion/issues/467"
},
{
"type": "PACKAGE",
"url": "https://github.com/intelliants/subrion"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99378"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:53:56Z",
"nvd_published_at": "2017-07-02T13:29:00Z"
}
}
@@ -1,35 +1,55 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4f4h-jgjp-3vfg",
"modified": "2022-05-24T17:16:53Z",
"modified": "2024-04-25T21:54:41Z",
"published": "2022-05-24T17:16:53Z",
"aliases": [
"CVE-2020-12468"
],
"summary": "Subrion CMS CSV injection via Export Language",
"details": "Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "intelliants/subrion"
},
"versions": [
"4.2.1"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12468"
},
{
"type": "WEB",
"url": "https://belong2yourself.github.io/vulnerabilities/docs/Subrion%20CMS/CSV%20Injection/readme"
},
{
"type": "WEB",
"url": "https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/CSV%20Injection"
},
{
"type": "PACKAGE",
"url": "https://github.com/intelliants/subrion"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:54:41Z",
"nvd_published_at": "2020-04-29T21:15:00Z"
}
}
@@ -0,0 +1,72 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4j79-4m6q-77vf",
"modified": "2024-04-25T21:54:12Z",
"published": "2022-05-14T02:00:54Z",
"aliases": [
"CVE-2017-5543"
],
"summary": "Subrion CMS PHP Object Injection",
"details": "`includes/classes/ia.core.users.php` in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "intelliants/subrion"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.5"
},
{
"fixed": "4.1.0"
}
]
}
],
"versions": [
"4.0.5"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5543"
},
{
"type": "WEB",
"url": "https://github.com/intelliants/subrion/issues/297"
},
{
"type": "WEB",
"url": "https://github.com/intelliants/subrion/commit/019dee20a38f39a5827aae2eb92f09b1f6afb7bb"
},
{
"type": "PACKAGE",
"url": "https://github.com/intelliants/subrion"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95688"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:54:12Z",
"nvd_published_at": "2017-01-20T08:59:00Z"
}
}
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6wc4-v4v5-3m82",
"modified": "2024-04-25T21:54:23Z",
"published": "2022-05-14T02:00:53Z",
"aliases": [
"CVE-2018-15563"
],
"summary": "Subrion CMS Stored Cross-site Scripting (XSS)",
"details": "`_core/admin/pages/add/` in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "intelliants/subrion"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.2.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15563"
},
{
"type": "WEB",
"url": "https://cxsecurity.com/issue/WLB-2018090261"
},
{
"type": "PACKAGE",
"url": "https://github.com/intelliants/subrion"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:54:23Z",
"nvd_published_at": "2018-10-02T18:29:00Z"
}
}
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9738-c49q-4rgc",
"modified": "2022-05-14T02:00:32Z",
"modified": "2024-04-25T21:54:26Z",
"published": "2022-05-14T02:00:32Z",
"aliases": [
"CVE-2018-16327"
],
"summary": "Subrion Cross-site Scripting (XSS)",
"details": "There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.",
"severity": [
{
@@ -14,7 +15,15 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "intelliants/subrion"
},
"versions": [
"4.2.1"
]
}
],
"references": [
{
@@ -24,6 +33,14 @@
{
"type": "WEB",
"url": "https://github.com/intelliants/subrion/issues/771"
},
{
"type": "WEB",
"url": "https://github.com/intelliants/subrion/commit/ec8e6e8984eeebfaf0d8022f4c07aa508624ee18"
},
{
"type": "PACKAGE",
"url": "https://github.com/intelliants/subrion"
}
],
"database_specific": {
@@ -31,8 +48,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:54:26Z",
"nvd_published_at": "2018-09-01T22:29:00Z"
}
}
@@ -1,23 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c4wx-3x5q-hf4w",
"modified": "2022-05-24T17:17:57Z",
"modified": "2024-04-25T21:54:34Z",
"published": "2022-05-24T17:17:57Z",
"aliases": [
"CVE-2019-20390"
],
"summary": "Subrion CMS Cross-Site Request Forgery (CSRF) vulnerability",
"details": "A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a GET request. An attacker can craft a panel/uploads/read.json?cmd=rm URL (removing this token) and send it to the victim.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "intelliants/subrion"
},
"versions": [
"4.2.1"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20390"
},
{
"type": "PACKAGE",
"url": "https://github.com/intelliants/subrion"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/157700/Subrion-CMS-4.2.1-Cross-Site-Request-Forgery.html"
@@ -25,11 +41,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:54:34Z",
"nvd_published_at": "2020-05-15T18:15:00Z"
}
}
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fmqq-hw9m-448q",
"modified": "2024-04-25T21:54:38Z",
"published": "2022-05-24T17:16:53Z",
"aliases": [
"CVE-2020-12469"
],
"summary": "Subrion CMS PHP Object Injection",
"details": "admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "intelliants/subrion"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.2.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12469"
},
{
"type": "WEB",
"url": "https://belong2yourself.github.io/vulnerabilities/docs/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection/readme"
},
{
"type": "WEB",
"url": "https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection"
},
{
"type": "PACKAGE",
"url": "https://github.com/intelliants/subrion"
}
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:54:38Z",
"nvd_published_at": "2020-04-29T21:15:00Z"
}
}
@@ -0,0 +1,72 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jj94-j4r3-5gr4",
"modified": "2024-04-25T21:54:28Z",
"published": "2022-05-24T19:10:19Z",
"aliases": [
"CVE-2020-22330"
],
"summary": "Subrion Cross-Site Scripting (XSS) vulnerability",
"details": "Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "intelliants/subrion"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.1"
},
{
"fixed": "4.2.2"
}
]
}
],
"versions": [
"4.2.1"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22330"
},
{
"type": "WEB",
"url": "https://github.com/intelliants/subrion/issues/850"
},
{
"type": "WEB",
"url": "https://github.com/intelliants/subrion/commit/06950c2f9c4aa69e323cbdd141beabb6a9273ca4"
},
{
"type": "WEB",
"url": "https://github.com/intelliants/subrion/commit/0e9180d2330a00b1ce8e7ec2e92e0a4e0612f1a9"
},
{
"type": "PACKAGE",
"url": "https://github.com/intelliants/subrion"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:54:28Z",
"nvd_published_at": "2021-08-06T14:15:00Z"
}
}
@@ -1,23 +1,49 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xhc3-5pgf-p576",
"modified": "2022-05-24T17:46:56Z",
"modified": "2024-04-25T21:54:32Z",
"published": "2022-05-24T17:46:56Z",
"aliases": [
"CVE-2020-23761"
],
"summary": "subrion CMS Cross Site Scripting (XSS) vulnerability",
"details": "Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the \"payment gateway\" column on transactions tab.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "intelliants/subrion"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.2.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23761"
},
{
"type": "PACKAGE",
"url": "https://github.com/intelliants/subrion"
},
{
"type": "WEB",
"url": "https://subrion.org"
@@ -32,8 +58,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:54:32Z",
"nvd_published_at": "2021-04-09T18:15:00Z"
}
}
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2xv7-fwh6-x7fc",
"modified": "2022-05-14T02:01:19Z",
"published": "2022-05-14T02:01:19Z",
"aliases": [
"CVE-2017-10795"
],
"details": "Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10795"
},
{
"type": "WEB",
"url": "https://github.com/intelliants/subrion/issues/467"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99378"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-02T13:29:00Z"
}
}
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4j79-4m6q-77vf",
"modified": "2022-05-14T02:00:54Z",
"published": "2022-05-14T02:00:54Z",
"aliases": [
"CVE-2017-5543"
],
"details": "includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5543"
},
{
"type": "WEB",
"url": "https://github.com/intelliants/subrion/issues/297"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95688"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-01-20T08:59:00Z"
}
}
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6wc4-v4v5-3m82",
"modified": "2022-05-14T02:00:53Z",
"published": "2022-05-14T02:00:53Z",
"aliases": [
"CVE-2018-15563"
],
"details": "_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15563"
},
{
"type": "WEB",
"url": "https://cxsecurity.com/issue/WLB-2018090261"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-02T18:29:00Z"
}
}
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fmqq-hw9m-448q",
"modified": "2022-05-24T17:16:53Z",
"published": "2022-05-24T17:16:53Z",
"aliases": [
"CVE-2020-12469"
],
"details": "admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12469"
},
{
"type": "WEB",
"url": "https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-29T21:15:00Z"
}
}
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jj94-j4r3-5gr4",
"modified": "2022-05-24T19:10:19Z",
"published": "2022-05-24T19:10:19Z",
"aliases": [
"CVE-2020-22330"
],
"details": "Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22330"
},
{
"type": "WEB",
"url": "https://github.com/intelliants/subrion/issues/850"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-06T14:15:00Z"
}
}