PT-2023-28984 · Basercms · Basercms

Shiga Takuma · Published 2023-10-26 · Updated 2023-11-06 · CVE-2023-43792

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions baserCMS versions 4.6.0 through 4.7.6

Description The issue is related to a Code Injection vulnerability in the mail form of baserCMS, a website development framework. This vulnerability allows malicious code to be executed in the Mail Form Feature.

Recommendations For versions 4.6.0 through 4.7.6, update to the latest version of baserCMS to resolve the issue. As a temporary workaround, consider restricting access to the mail form feature in baserCMS until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-43792

GHSA-VRM6-C878-FPQ6

Affected Products

Basercms

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43792.json · Exploit
• https://osv.dev/vulnerability/GHSA-vrm6-c878-fpq6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43792 · Security Note
• https://basercms.net/security/JVN_45547161 · Vendor Advisory
• https://github.com/baserproject/basercms · Note
• https://github.com/baserproject/basercms/security/advisories/GHSA-vrm6-c878-fpq6 · Note
• https://t.me/cvenotify/60225 · Telegram Post