GHSA-7w2v-35j3-xrm9
Suggest an improvement- Source
- https://github.com/advisories/GHSA-7w2v-35j3-xrm9
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-7w2v-35j3-xrm9/GHSA-7w2v-35j3-xrm9.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-7w2v-35j3-xrm9
- Aliases
- Published
- 2022-12-07T06:30:26Z
- Modified
- 2026-09-10T03:49:47Z
- Severity
-
- 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- baserCMS vulnerable to stored Cross-site Scripting
- Details
-
Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
- Database specific
{ "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2022-12-07T14:56:47Z", "nvd_published_at": "2022-12-07T04:15:00Z", "severity": "MODERATE" }- References
Affected packages
Packagist / baserproject/basercms
Package
- Name
- baserproject/basercms
- Purl
- pkg:composer/baserproject/basercms
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed4.7.2
Affected versions
0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
1.*
1.0.0
2.*
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
2.0.0-rc5
2.0.0-rc6
3.*
3.0.7
3.0.7.1
3.0.8
3.0.8.1
3.0.9
3.0.9.1
3.0.10
3.0.10.1
3.0.11
3.0.11.1
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.17
3.0.18
3.0.19
3.0.20
3.0.21
3.0.22
3.0.23
3.0.24
3.0.25
3.0.26
4.*
4.0.0-beta
4.0.0
4.0.1
4.0.2
4.0.2.1
4.0.3
4.0.4
4.0.5
4.0.5.1
4.0.5.2
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.0.10.1
4.0.11
4.1.0
4.1.0.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.7.1
4.4.0
4.4.1
4.4.1.1
4.4.2
4.4.2.1
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.6.0
4.6.1
4.6.1.1
4.6.2
4.6.3
4.7.0