CVE-2020-12469 - admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit

Back Back to CVE browser

MEDIUM

admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit

Published Apr 29, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 0.86%

Description

admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (4)

Link	Providers	Tags
https://belong2yourself.github.io/vulnerabilities/docs/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection/readme
https://github.com/advisories/GHSA-fmqq-hw9m-448q		Advisory
https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-12469