CVE-2017-5543 Subrion CMS PHP Object Injection
CriticalCVSS 9.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| intelliants/subrion(Packagist) | >= 4.0.5, < 4.1.0 | 4.1.0 |
| intelliants/subrion(Packagist) | = 4.0.5 | No fix listed |
| intelliants/subrion(Packagist) | = v4.0.5 | No fix listed |
| intelliants/subrion | = 4.0.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com patch
- github.com product
- 95688 third-party-advisory vdb-entry
- github.com