What is CVE-2019-20390?

CVE-2019-20390 is a Cross-Site Request Forgery (CSRF) vulnerability discovered in Subrion CMS 4.2.1.

How severe is CVE-2019-20390?

CVE-2019-20390 has a severity rating of 8.1, which is considered high.

Which software versions are affected by CVE-2019-20390?

CVE-2019-20390 affects Subrion CMS version 4.2.1.

How can CVE-2019-20390 be mitigated?

To mitigate CVE-2019-20390, it is recommended to update Subrion CMS to a version that includes a fix for the vulnerability.

Vulnerability/
CVE-2019-20390

high

8.1

CWE

352

15/5/2020

24/5/2022

5/8/2024

CVE-2019-20390: CSRF

First published: Fri May 15 2020(Updated: )

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a GET request. An attacker can craft a panel/uploads/read.json?cmd=rm URL (removing this token) and send it to the victim.

Credit: cve@mitre.org cve@mitre.org

Affected Software	Affected Version	How to fix
Intelliants Subrion	=4.2.1
composer/intelliants/subrion	=4.2.1
	=4.2.1

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2019-20390?
CVE-2019-20390 is a Cross-Site Request Forgery (CSRF) vulnerability discovered in Subrion CMS 4.2.1.
How does CVE-2019-20390 work?
CVE-2019-20390 allows a remote attacker to remove files on the server without a victim's knowledge by enticing an authenticated user to visit an attacker's web page.
How severe is CVE-2019-20390?
CVE-2019-20390 has a severity rating of 8.1, which is considered high.
Which software versions are affected by CVE-2019-20390?
CVE-2019-20390 affects Subrion CMS version 4.2.1.
How can CVE-2019-20390 be mitigated?
To mitigate CVE-2019-20390, it is recommended to update Subrion CMS to a version that includes a fix for the vulnerability.

collector/nvd-index
agent/type
collector/github-advisory-latest
source/GitHub
alias/GHSA-c4wx-3x5q-hf4w
alias/CVE-2019-20390
agent/software-canonical-lookup
agent/weakness
agent/references
agent/severity
agent/description
agent/author
agent/softwarecombine
collector/nvd-cve
source/NVD
collector/github-advisory
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/tags
agent/event
agent/first-publish-date
agent/trending
vendor/intelliants
canonical/intelliants subrion
version/intelliants subrion/4.2.1
package-manager/composer

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.