CVE-2019-20390
CVE-2019-20390
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a GET request. An attacker can craft a panel/uploads/read.json?cmd=rm URL (removing this token) and send it to the victim.
CVSS 8.1 · High · EPSS 0.7%
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
intelliants/subrion Packagist
- Versions
- 4.2.1
No fix published