GHSA-h4cc-fxpp-pgw9

Suggest an improvement
Source
https://github.com/advisories/GHSA-h4cc-fxpp-pgw9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-h4cc-fxpp-pgw9/GHSA-h4cc-fxpp-pgw9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h4cc-fxpp-pgw9
Aliases
Published
2023-03-23T20:00:08Z
Modified
2026-09-10T03:49:24Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
baserCMS File Uploader Remote Code Execution (RCE) vulnerability
Details

Impact

There is a Remote Code Execution (RCE) Vulnerability on the management system of baserCMS.

Target

baserCMS 4.7.3 and earlier versions

Patches

Update to the latest version of baserCMS

Credits

島峰泰平＠三井物産セキュアディレクション株式会社

Database specific 
{
    "cwe_ids": [
        "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-23T20:00:08Z",
    "nvd_published_at": "2023-03-23T20:15:00Z",
    "severity": "CRITICAL"
}
References

Affected packages

Packagist / baserproject/basercms

Package

Name
baserproject/basercms
Purl
pkg:composer/baserproject/basercms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.7.5

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
1.*
1.0.0
2.*
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
2.0.0-rc5
2.0.0-rc6
3.*
3.0.7
3.0.7.1
3.0.8
3.0.8.1
3.0.9
3.0.9.1
3.0.10
3.0.10.1
3.0.11
3.0.11.1
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.17
3.0.18
3.0.19
3.0.20
3.0.21
3.0.22
3.0.23
3.0.24
3.0.25
3.0.26
4.*
4.0.0-beta
4.0.0
4.0.1
4.0.2
4.0.2.1
4.0.3
4.0.4
4.0.5
4.0.5.1
4.0.5.2
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.0.10.1
4.0.11
4.1.0
4.1.0.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.7.1
4.4.0
4.4.1
4.4.1.1
4.4.2
4.4.2.1
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.6.0
4.6.1
4.6.1.1
4.6.2
4.6.3
4.7.0
4.7.2
4.7.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-h4cc-fxpp-pgw9/GHSA-h4cc-fxpp-pgw9.json"