Medium severity · published Aug 2, 2018
CVE-2018-14835
Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Subrion Cms · Subrion
4.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-14835
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-14835
Exploit
https://github.com/intelliants/subrion/issues/760
Patch
https://github.com/intelliants/subrion/pull/763/commits
More from Subrion Cms
6.5
CVE-2018-14836
Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but not perform actions) if the Guests user…