PT-2020-17325
CVE-2020-35437
·
تاريخ النشر
2020-12-26
·
تاريخ التحديث
2022-07-17
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Subrion CMS version 4.2.1
Description
The issue is related to Cross Site Scripting (XSS) through the
avatar[path] parameter in a POST request to the "/ core/profile/" URI. This allows for potential malicious script execution.Recommendations
For Subrion CMS version 4.2.1, consider restricting access to the
/core/profile/ URI or disabling the avatar[path] parameter to minimize the risk of exploitation until a patch is available. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾