CVE-2018-21037: Intelliants/subrion Subrion CMS CSRF Vulnerability Vulnerability
HIGHCVE-2018-21037 is a HIGH (CVSS 8.8) subrion cms csrf vulnerability vulnerability (CWE-352: Cross-Site Request Forgery (CSRF)) affecting Intelliants/subrion libraries in the Packagist ecosystem. The issue involves subrion cms csrf vulnerability. Remediation is available by upgrading affected packages to version 4.2.1.
CVE-2018-21037 at a Glance
Security Impact
CVSS: 8.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
How to Fix CVE-2018-21037
To remediate this vulnerability, upgrade all affected Intelliants/subrion dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade intelliants/subrion to 4.2.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for intelliants/subrionHow to Check if You Are Affected
To determine whether your application is affected by CVE-2018-21037, inspect your project dependencies for Intelliants/subrion:
inspect dependencies for intelliants/subrionAnalyze the terminal output to locate any version of Intelliants/subrion in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.2.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-352: Cross-Site Request Forgery (CSRF), where the web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. In Intelliants/subrion, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2018-21037 Affected Intelliants/subrion Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
intelliants/subrion
|
Packagist |
< 4.2.1
|
4.2.1
|
References
Frequently Asked Questions
What is CVE-2018-21037?
Which Intelliants/subrion versions are affected?
What version fixes CVE-2018-21037?
Is intelliants/subrion affected?
What is the CVSS score of CVE-2018-21037?
What CWE is associated with CVE-2018-21037?
How can I check Packagist dependencies for CVE-2018-21037?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-g8j7-w673-4mjp",
"modified" : "2023-10-05T17:52:48Z",
"published" : "2022-05-24T17:11:40Z",
"aliases" : [ "CVE-2018-21037" ],
"summary" : "Subrion CMS CSRF Vulnerability",
"details" : "Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the `panel/members/edit/1` URI.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "intelliants/subrion"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.2.1"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2018-21037"
}, {
"type" : "WEB",
"url" : "https://github.com/intelliants/subrion/issues/638"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/intelliants/subrion"
}, {
"type" : "WEB",
"url" : "https://github.com/intelliants/subrion/blob/c8aaeb04f44554e454be9763527a7be7fbe7bfd5/changelog.txt#L899"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-352" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2023-07-20T00:02:45Z",
"nvd_published_at" : "2020-03-17T15:15:00Z"
}
}