CVE-2019-20389

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the v[language_switch] parameter (within multipart/form-data), which is reflected back within a user's browser without proper output encoding.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-20395.0In rw_i93_sm_detect_ndef of rw_i93.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local informaCVE-2019-203908.1A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the sCVE-2019-203916.5An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is uCVE-2019-203926.5An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is uCVE-2019-203938.8A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyanCVE-2019-203948.8A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. ApplCVE-2019-203956.5A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications thatCVE-2019-203966.5A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsinCVE-2019-203978.8A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications thatCVE-2019-203986.5A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved eCVE-2019-203995.9A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak CVE-2019-20405.0In rw_i93_process_ext_sys_info of rw_i93.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local i
CVE-2019-20389: Medium severity, CVSS 6.1 | Vulnix