CVE-2018-14835

Description

Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.

How to fix CVE-2018-14835

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• Packagist/intelliants/subrion—no fix listed

Is CVE-2018-14835 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 4.2.1

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-14835
• PATCHgithub.com/intelliants/subrion
• WEBgithub.com/intelliants/subrion/commit/a33a224c6c9e25144d828f92f6141c719215094b
• WEBgithub.com/intelliants/subrion/issues/760
• WEB