CVE-2019-7357

Description

Subrion CMS 4.2.1 has CSRF in `panel/modules/plugins/`. The attacker can remotely activate/deactivate the plugins.

How to fix CVE-2019-7357

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• Packagist/intelliants/subrion—no fix listed

Is CVE-2019-7357 being exploited?

Low — EPSS is 1.6%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 4.2.1

CVSS scores

References (3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-7357
• PATCHgithub.com/intelliants/subrion
• WEBgithub.com/ngpentest007/CVE-2019-7357/blob/main/Subrion_4.2.1%20-%20CVE-2019-7357.pdf