CVE-2019-20389: XSS
An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the v[languageswitch] parameter (within multipart/form-data), which is reflected back within a user's browser without proper output encoding.
Other sources
An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the v[languageswitch] parameter (within multipart/form-data), which is reflected back within a user's browser without proper output encoding.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-20389?
The severity of CVE-2019-20389 is medium.
What software is affected by CVE-2019-20389?
Subrion CMS 4.2.1 is affected by CVE-2019-20389.
What is the CWE category of CVE-2019-20389?
The CWE category of CVE-2019-20389 is CWE-79.
How can a remote attacker exploit CVE-2019-20389?
A remote attacker can exploit CVE-2019-20389 by injecting arbitrary JavaScript code in the `v[language_switch]` parameter on the Subrion CMS 4.2.1 /panel/configuration/general settings page.
Is there a fix available for CVE-2019-20389?
As of now, there is no information on an official fix for CVE-2019-20389. It is recommended to follow the recommendations provided by the vendor or software developer.