CVE-2020-15159
Cross Site Scripting and RCE in baserCMS
Summary
Cross Site Scripting and RCE in baserCMS
Original description
The description as published by the source.
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).
- Impact: XSS to RCE via Arbitrary file upload.
- Attack vector is: Administrator must be logged in.
- Components are: ThemeFilesController.php, UploaderFilesController.php.
- Tested baserCMS Version : 4.3.6 (Latest)
- Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE)
- Patches : https://basercms.net/security/20200827
Found by Vulnerability Research team in Flatt Security Inc.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Packagist
baserproject/basercms
[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.3.7"}]}]
References
- advisory nvd.nist.gov
- web github.com
- web github.com
- web basercms.net