Medium severity · published Aug 2, 2018
CVE-2018-14836
Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but not perform actions) if the Guests user…
6.5
CVSS
1%
EPSS
No
On KEV
Description
Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but not perform actions) if the Guests user group has access to the Admin panel.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Subrion Cms · Subrion
4.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-14836
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-14836
Third Party Advisory
https://github.com/intelliants/subrion/issues/762
More from Subrion Cms
5.4
CVE-2018-14835
Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas