CVE-2020-15159
Cross Site Scripting and RCE in baserCMS
概要
Cross Site Scripting and RCE in baserCMS
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).
- Impact: XSS to RCE via Arbitrary file upload.
- Attack vector is: Administrator must be logged in.
- Components are: ThemeFilesController.php, UploaderFilesController.php.
- Tested baserCMS Version : 4.3.6 (Latest)
- Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE)
- Patches : https://basercms.net/security/20200827
Found by Vulnerability Research team in Flatt Security Inc.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Packagist
baserproject/basercms
[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.3.7"}]}]
参照URL
- advisory nvd.nist.gov
- web github.com
- web github.com
- web basercms.net