CVE Vulnerability

CVE-2020-15273

baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

8.1 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://packagist.org/packages/baserproject/basercms Third Party Advisory
https://github.com/baserproject/basercms/security/advisories/GHSA-wpww-4jf4-4hx8 Patch Third Party Advisory
https://github.com/baserproject/basercms/commit/b70474ef9dcee6ad8826360884625dc7ca9041a1 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*
Information

Published : 2020-10-30 07:15

Updated : 2020-11-03 04:57

NVD link : CVE-2020-15273

Mitre link : CVE-2020-15273

Products Affected
No products.
CWE
CWE-79