GHSA-cpxc-67rc-c775

Suggest an improvement
Source
https://github.com/advisories/GHSA-cpxc-67rc-c775
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-cpxc-67rc-c775/GHSA-cpxc-67rc-c775.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cpxc-67rc-c775
Aliases
Related
Published
2020-08-28T20:48:12Z
Modified
2026-03-13T22:01:35.810422Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Cross Site Scripting in baserCMS
Details

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS).

  • Impact: XSS via Arbitrary script execution.
  • Attack vector is: Administrator must be logged in.
  • Components are: contentfields.php, contentinfo.php, contentoptions.php, contentrelated.php, indexlisttree.php, jquery.bcTree.js
  • Tested baserCMS Version : 4.3.6 (Latest)
  • Affected baserCMS Version : 4.0.0 ~ 4.3.6
  • Patches : https://basercms.net/security/20200827

Found by Aquilao Null

Database specific 
{
    "github_reviewed": true,
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2020-08-28T20:47:58Z",
    "severity": "LOW"
}
References

Affected packages

Packagist / baserproject/basercms

Package

Name
baserproject/basercms
Purl
pkg:composer/baserproject/basercms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.3.7

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.2.1
4.0.3
4.0.4
4.0.5
4.0.5.1
4.0.5.2
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.0.10.1
4.0.11
4.1.0
4.1.0.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-cpxc-67rc-c775/GHSA-cpxc-67rc-c775.json"
last_known_affected_version_range 
"<= 4.3.6"