CVE-2019-20390: CSRF
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a GET request. An attacker can craft a panel/uploads/read.json?cmd=rm URL (removing this token) and send it to the victim.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-20390?
CVE-2019-20390 is a Cross-Site Request Forgery (CSRF) vulnerability discovered in Subrion CMS 4.2.1.
How does CVE-2019-20390 work?
CVE-2019-20390 allows a remote attacker to remove files on the server without a victim's knowledge by enticing an authenticated user to visit an attacker's web page.
How severe is CVE-2019-20390?
CVE-2019-20390 has a severity rating of 8.1, which is considered high.
Which software versions are affected by CVE-2019-20390?
CVE-2019-20390 affects Subrion CMS version 4.2.1.
How can CVE-2019-20390 be mitigated?
To mitigate CVE-2019-20390, it is recommended to update Subrion CMS to a version that includes a fix for the vulnerability.