6.5med
CVE-2018-14836
Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 63%
Public exploits
0
none known
Summary
Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but not perform actions) if the Guests user group has access to the Admin panel.
Exploit prediction (EPSS)
1.00% probability of exploitation in the next 30 days, higher than 63% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Classification
- Weakness
- CWE-269 Improper Privilege Management
References
- github.com /intelliants/subrion/issues/762 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-14836
- NVD: CVE-2018-14836
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.