What is GHSA-395x-wv32-44v5?

GHSA-395x-wv32-44v5 is a security advisory published by GitHub Security Advisories with Medium severity. baserproject/basercms vulnerable to cross-site scripting (XSS) vulnerability

Which CVE IDs does GHSA-395x-wv32-44v5 cover?

GHSA-395x-wv32-44v5 covers the following CVE IDs: CVE-2022-39325. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-395x-wv32-44v5?

GHSA-395x-wv32-44v5 has a CVSS v3 base score of 4.6, published by GitHub Security Advisories.

Which products are affected by GHSA-395x-wv32-44v5?

GHSA-395x-wv32-44v5 affects 1 product, including: composer/baserproject/basercms:\u003c= 4.7.1.

GHSA-395x-wv32-44v5MediumCVSS 4.6

baserproject/basercms vulnerable to cross-site scripting (XSS) vulnerability

Vendor

GitHub Security Advisories

Published

November 28, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-39325 →

📋 Description

There is a cross-site scripting vulnerability on the management system of baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.

Target

baserCMS 4.7.1 and earlier versions.

Vulnerability

Execution of malicious JavaScript code may alter the display of the page or leak cookie information.

In Favorite registration (CVE-2022-39325)
In Permission Settings (CVE-2022-41994)
In User group management (CVE-2022-42486)

Countermeasures

Update to the latest version of baserCMS

Credits

Shogo Iyota@Mitsui Bussan Secure Directions, Inc.
YUYA KOTAKE@CARTA HOLDINGS, INC.

🎯 Affected products1

composer/baserproject/basercms:<= 4.7.1