PT-2021-23208 · Basercms · Basercms

Akagi Yusuke · Published 2021-11-26 · Updated 2021-12-01 · CVE-2021-41243

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions baserCMS versions 4.5.3 and earlier

Description The management system of baserCMS has a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This issue needs to be addressed when the management system is used by an unspecified number of users.

Recommendations Update to the latest version of baserCMS. As a temporary workaround, consider restricting file upload permissions to minimize the risk of exploitation. Avoid using the file upload feature until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-41243

GHSA-7RPC-9M88-CF9W

Affected Products

Basercms

References · 7

• https://github.com/baserproject/basercms/commit/9088b99c329d1faff3a2f1269f37b9a9d8d5f6ff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41243 · Security Note
• https://osv.dev/vulnerability/GHSA-7rpc-9m88-cf9w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41243 · Vendor Advisory
• https://github.com/baserproject/basercms · Note
• https://github.com/baserproject/basercms/security/advisories/GHSA-7rpc-9m88-cf9w · Note
• https://t.me/cibsecurity/33004 · Telegram Post