Vulnerability Details CVE-2018-14840
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.035
EPSS Ranking 87.1%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
- https://github.com/intelliants/subrion/commit/cb10ac2294cb2c3a6d2159f9a2bb8c58a2a10a47
- https://github.com/intelliants/subrion/issues/773
- https://www.exploit-db.com/exploits/45150/
- https://github.com/intelliants/subrion/commit/cb10ac2294cb2c3a6d2159f9a2bb8c58a2a10a47
- https://github.com/intelliants/subrion/issues/773
- https://www.exploit-db.com/exploits/45150/
Products affected by CVE-2018-14840
-
cpe:2.3:a:intelliants:subrion:4.2.1