CVE-2012-5452: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) multititle parameter to blocks/add/; (2) cost, (3) days, or (4) title[en] parameter to plans/add/; (5) name or (6) title[en] parameter to fields/group/add/ in admin/manage/; or (7) f[accounts][fullname] or (8) f[accounts][username] parameter to advsearch/. NOTE: This might overlap CVE-2011-5211. NOTE: it was later reported that the f[accounts][fullname] and f[accounts][username] vectors might also affect 2.2.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5452?
CVE-2012-5452 has a medium severity rating due to its potential for exploitation via cross-site scripting.
How do I fix CVE-2012-5452?
To fix CVE-2012-5452, it is recommended to update Subrion CMS to the latest version that addresses these XSS vulnerabilities.
What impact does CVE-2012-5452 have on Subrion CMS?
CVE-2012-5452 allows remote attackers to inject arbitrary web scripts or HTML into Subrion CMS, potentially compromising user data.
Who is affected by CVE-2012-5452?
Any user or site utilizing Subrion CMS version 2.2.1 is affected by CVE-2012-5452.
What specific vectors are exploited in CVE-2012-5452?
CVE-2012-5452 exploits multiple input parameters such as multi_title, cost, days, title[en], name, and others.