PT-2021-23238 · Basercms · Basercms

Daniele Scanu · Published 2021-11-26 · Updated 2021-12-01 · CVE-2021-41279

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions baserCMS versions 4.5.3 and earlier

Description The issue affects baserCMS, an open source content management system with a focus on Japanese language support. Users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.

Recommendations For baserCMS versions 4.5.3 and earlier, update to the latest version of baserCMS as soon as possible. As a temporary workaround, consider restricting upload privileges to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-41279

GHSA-4X2F-54WR-4HJG

Affected Products

Basercms

References · 7

• https://github.com/baserproject/basercms/commit/d8ab0a81a7bce35cc95ff7dff851a7e87a084336 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41279 · Security Note
• https://osv.dev/vulnerability/GHSA-4x2f-54wr-4hjg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41279 · Vendor Advisory
• https://github.com/baserproject/basercms · Note
• https://github.com/baserproject/basercms/security/advisories/GHSA-4x2f-54wr-4hjg · Note
• https://t.me/cibsecurity/32999 · Telegram Post