PT-2021-22397 · Basercms · Basercms

Yusuke Akagi · Published 2021-08-25 · Updated 2021-08-30 · CVE-2021-39136

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions baserCMS versions 4.5.1 and earlier

Description The issue is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS, which is an open source content management system with a focus on Japanese language support. This vulnerability may allow the execution of malicious JavaScript code, potentially altering the display of the page or leaking cookie information. Users are advised to update as soon as possible.

Recommendations For baserCMS versions 4.5.1 and earlier, update to the latest version of baserCMS as soon as possible to resolve the issue. As a temporary workaround, consider restricting access to the file upload function in the management system until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-39136

GHSA-HGJR-632X-QPP3

Affected Products

Basercms

References · 10

• https://github.com/baserproject/basercms/commit/568d4cab5ba1cdee7bbf0133c676d02a98f6d7bc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-39136 · Security Note
• https://basercms.net/security/JVN_14134801 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39136 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hgjr-632x-qpp3 · Vendor Advisory
• https://github.com/baserproject/basercms · Note
• https://github.com/baserproject/basercms/security/advisories/GHSA-hgjr-632x-qpp3 · Note
• https://t.me/cibsecurity/27884 · Telegram Post
• https://t.me/cvenotify/20234 · Telegram Post
• http://jvn.jp/en/jp/JVN14134801/index.html · Note