CVE-2020-15159
Cross Site Scripting and RCE in baserCMS
Résumé
Cross Site Scripting and RCE in baserCMS
Description d'origine
La description telle que publiée par la source (souvent en anglais).
baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).
- Impact: XSS to RCE via Arbitrary file upload.
- Attack vector is: Administrator must be logged in.
- Components are: ThemeFilesController.php, UploaderFilesController.php.
- Tested baserCMS Version : 4.3.6 (Latest)
- Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE)
- Patches : https://basercms.net/security/20200827
Found by Vulnerability Research team in Flatt Security Inc.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Packagist
baserproject/basercms
[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.3.7"}]}]
Références
- advisory nvd.nist.gov
- web github.com
- web github.com
- web basercms.net