CVE-2020-18325: n/a stored XSS — UNKNOWN

CISO Take

This CVE is a stored Cross-Site Scripting vulnerability in the Configuration panel of Intelliants Subrion CMS v4.2.1 — a general-purpose open-source CMS, not an AI/ML package, framework, or inference component. It carries an EPSS score of just 0.0163 (low absolute exploitation probability, though the platform ranks it in the top 27% of scored CVEs by relative likelihood), is not in CISA KEV, has no CISA SSVC decision, and no confirmed public exploit or Nuclei scanner template despite a public GitHub write-up existing. Because Subrion doesn't appear in this platform's tracked AI/ML package catalog and the description gives no indication it touches model serving, agents, or inference pipelines, this should be treated as a low-priority, non-AI-specific finding — relevant only if your organization happens to run Subrion CMS as general web infrastructure (e.g., a docs or marketing site) alongside AI products. If you do run Subrion, restrict admin panel access, apply input sanitization/CSP, and check for a patched release beyond 4.2.1; otherwise no action is needed from an AI security standpoint.

Sources: NVD EPSS

What is the risk?

Low risk. This is a classic stored XSS pattern requiring some level of authenticated access to the CMS configuration panel to inject a payload, and a victim (typically a higher-privileged admin) to view the affected page for it to trigger. No CVSS score is published, EPSS is very low (0.0163), it's absent from CISA KEV, and there's no evidence of a working public exploit or scanner coverage. The primary exposure is session hijacking or admin-panel takeover rather than direct data compromise or remote code execution.

How does the attack unfold?

Initial Access

Attacker obtains low-privileged or compromised credentials granting access to the Subrion CMS Configuration panel.

Exploitation

Attacker injects a malicious script into an unsanitized configuration field, creating a stored XSS payload.

Impact

A higher-privileged administrator views the panel, executing the payload in their session and exposing it to hijacking or further CMS compromise.

Initial Access

Attacker obtains low-privileged or compromised credentials granting access to the Subrion CMS Configuration panel.

Exploitation

Attacker injects a malicious script into an unsanitized configuration field, creating a stored XSS payload.

Impact

A higher-privileged administrator views the panel, executing the payload in their session and exposing it to hijacking or further CMS compromise.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

1.6%

chance of exploitation in 30 days

Higher than 74% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

Upgrade Subrion CMS beyond v4.2.1 to a version with input sanitization/output encoding fixes for the Configuration panel; if no patch is confirmed available, apply manual output encoding or a WAF rule blocking script payloads in config fields as a stopgap. Restrict access to the admin Configuration panel via network ACLs, VPN, or IP allowlisting, and enforce MFA for all admin accounts. Deploy a strict Content-Security-Policy to reduce the blast radius of any successful injection, and review admin session logs for anomalous script-like input in configuration values.

How is it classified?

Code Execution Auth Bypass Plugin

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2020-18325?

This CVE is a stored Cross-Site Scripting vulnerability in the Configuration panel of Intelliants Subrion CMS v4.2.1 — a general-purpose open-source CMS, not an AI/ML package, framework, or inference component. It carries an EPSS score of just 0.0163 (low absolute exploitation probability, though the platform ranks it in the top 27% of scored CVEs by relative likelihood), is not in CISA KEV, has no CISA SSVC decision, and no confirmed public exploit or Nuclei scanner template despite a public GitHub write-up existing. Because Subrion doesn't appear in this platform's tracked AI/ML package catalog and the description gives no indication it touches model serving, agents, or inference pipelines, this should be treated as a low-priority, non-AI-specific finding — relevant only if your organization happens to run Subrion CMS as general web infrastructure (e.g., a docs or marketing site) alongside AI products. If you do run Subrion, restrict admin panel access, apply input sanitization/CSP, and check for a patched release beyond 4.2.1; otherwise no action is needed from an AI security standpoint.

Is CVE-2020-18325 actively exploited?

No confirmed active exploitation of CVE-2020-18325 has been reported, but organizations should still patch proactively.

How to fix CVE-2020-18325?

Upgrade Subrion CMS beyond v4.2.1 to a version with input sanitization/output encoding fixes for the Configuration panel; if no patch is confirmed available, apply manual output encoding or a WAF rule blocking script payloads in config fields as a stopgap. Restrict access to the admin Configuration panel via network ACLs, VPN, or IP allowlisting, and enforce MFA for all admin accounts. Deploy a strict Content-Security-Policy to reduce the blast radius of any successful injection, and review admin session logs for anomalous script-like input in configuration values.

What is the CVSS score for CVE-2020-18325?

No CVSS score has been assigned yet.

What are the technical details?

Original Advisory

Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.

Exploitation Scenario

An attacker who obtains low-privileged or compromised credentials for Subrion CMS injects a malicious JavaScript payload into an unsanitized field within the Configuration panel. When a higher-privileged administrator subsequently opens that panel, the script executes in their authenticated browser session, allowing the attacker to steal session cookies, perform actions as the admin, or escalate to full CMS control. If this CMS instance also hosts content adjacent to AI products (e.g., a docs site), the compromised admin session could be leveraged to pivot toward credentials or systems with broader access.