PT-2020-14331 · Basercms · Basercms

Aquilao · Published 2020-10-30 · Updated 2020-11-04 · CVE-2020-15273

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions baserCMS versions 4.0.0 through 4.4.0

Description The issue affects several components, including Edit feed settings, Edit widget area, Sub site new registration, and New category registration. It allows arbitrary JavaScript execution by entering specific characters in certain areas, such as the account that can access the file upload function, category list, subsite setting list, widget area edit, and feed list on the management screen. The attack vector requires an administrator to be logged in. The issue was introduced in version 4.0.0 and is fixed in version 4.4.1.

Recommendations For versions 4.0.0 through 4.4.0, update to version 4.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the affected components, such as Edit feed settings, Edit widget area, Sub site new registration, and New category registration, until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-15273

GHSA-WPWW-4JF4-4HX8

Affected Products

Basercms

References · 6

• https://github.com/baserproject/basercms/commit/b70474ef9dcee6ad8826360884625dc7ca9041a1 · Patch
• https://github.com/baserproject/basercms/security/advisories/GHSA-wpww-4jf4-4hx8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15273 · Security Note
• https://osv.dev/vulnerability/GHSA-wpww-4jf4-4hx8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15273 · Vendor Advisory
• https://packagist.org/packages/baserproject/basercms · Note