GHSA-cpxc-67rc-c775

Suggest an improvement
Source
https://github.com/advisories/GHSA-cpxc-67rc-c775
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-cpxc-67rc-c775/GHSA-cpxc-67rc-c775.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cpxc-67rc-c775
Aliases
Published
2020-08-28T20:48:12Z
Modified
2023-11-08T04:02:31.495824Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Cross Site Scripting in baserCMS
Details

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS).

  • Impact: XSS via Arbitrary script execution.
  • Attack vector is: Administrator must be logged in.
  • Components are: contentfields.php, contentinfo.php, contentoptions.php, contentrelated.php, indexlisttree.php, jquery.bcTree.js
  • Tested baserCMS Version : 4.3.6 (Latest)
  • Affected baserCMS Version : 4.0.0 ~ 4.3.6
  • Patches : https://basercms.net/security/20200827

Found by Aquilao Null

Database specific
{
    "nvd_published_at": null,
    "github_reviewed_at": "2020-08-28T20:47:58Z",
    "severity": "LOW",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Packagist / baserproject/basercms

Package

Name
baserproject/basercms
Purl
pkg:composer/baserproject/basercms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.3.7

Database specific

{
    "last_known_affected_version_range": "<= 4.3.6"
}