CVE-2020-15273

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-15273
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15273.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-15273
Aliases
Related
Published
2020-10-30T19:15:12.597Z
Modified
2026-04-10T04:22:52.799299Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1.

References

Affected packages

Git / github.com/baserproject/basercms

Affected ranges

Type
GIT
Repo
https://github.com/baserproject/basercms
Events
Introduced
d14d49950dfdd88415232259e2e592d8f118856a
Fixed
adf218e5dcd797b332c9bd9dae69b15e73ba09de
Fixed
b70474ef9dcee6ad8826360884625dc7ca9041a1
Database specific 
{
    "versions": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.4.1"
        }
    ]
}

Affected versions

4.*
4.0.0
4.0.6
4.0.7
4.1.0
4.1.0.1
4.1.1
4.1.2
4.2.2
4.2.4
4.3.0
4.3.3
4.3.5
4.3.6
4.3.7
4.3.7.1
4.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15273.json"