GHSA-673x-f5wx-fxpwLowCVSS 7.6

Cross Site Scripting and RCE in baserCMS

Published
August 28, 2020
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2020-15159 →

📋 Description

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).

  • Impact: XSS to RCE via Arbitrary file upload.
  • Attack vector is: Administrator must be logged in.
  • Components are: ThemeFilesController.php, UploaderFilesController.php.
  • Tested baserCMS Version : 4.3.6 (Latest)
  • Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE)
  • Patches : https://basercms.net/security/20200827

Found by Vulnerability Research team in Flatt Security Inc.

🎯 Affected products1

  • composer/baserproject/basercms:>= 4.0.0, <= 4.3.6

🔗 References (5)