CVE-2022-41994

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-41994
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41994.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-41994
Aliases
Published
2022-12-07T00:00:00Z
Modified
2026-07-08T06:03:22.538096383Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "versions prior to 4.7.2"
                },
                {
                    "last_affected": "versions prior to 4.7.2"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41994.json",
    "cna_assigner": "jpcert"
}
References

Affected packages

Git / github.com/baserproject/basercms

Affected ranges

Type
GIT
Repo
https://github.com/baserproject/basercms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3b46ad035e6d5d9bf907ac78daa865ee0d43f363
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.7.2"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.0-beta
2.0.1
2.0.2
2.0.3
2.1.0
2.1.2
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.5.1
3.0.6
3.0.6-beta
3.0.7
4.*
4.0.0
4.0.0-beta
4.0.6
4.0.7
4.1.0
4.1.0.1
4.1.1
4.1.2
4.2.2
4.2.4
4.3.0
4.3.3
4.3.5
4.3.6
4.3.7
4.3.7.1
4.4.0
4.4.1.1
4.4.2.1
4.4.3
4.4.4
4.4.6
4.4.8
4.5.0
4.5.1
4.5.2
4.6.0
4.6.1
4.6.1.1
4.6.2
4.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41994.json"