~ / search / GHSA-4f4h-jgjp-3vfg

GHSA-4f4h-jgjp-3vfg

Subrion CMS CSV injection via Export Language

Source: GitHub Advisory Database (reviewed) High CVE-2020-12468

Packages

EcosystemPackageAffectedFixed in
Packagist intelliants/subrion 4.2.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/.

References

External links from the advisory. They lead to third-party sites.