CVE-2020-15273 - OpenCVE

baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:S/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Basercms	Basercms

Configuration 1 [-]

cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/baserproject/basercms/commit/b70474ef9dcee6ad8826360884625dc7ca9041a1
https://github.com/baserproject/basercms/security/advisories/GHSA-wpww-4jf4-4hx8
https://packagist.org/packages/baserproject/basercms

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2020-10-30T19:10:16

Updated: 2024-08-04T13:15:19.029Z

Reserved: 2020-06-25T00:00:00

Link: CVE-2020-15273

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2020-10-30T19:15:12.597

Modified: 2020-11-03T16:57:43.317

Link: CVE-2020-15273

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "basercms", "vendor": "baserproject", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.4.1"}]}], "descriptions": [{"lang": "en", "value": "baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-10-30T19:10:16", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-wpww-4jf4-4hx8"}, {"tags": ["x_refsource_MISC"], "url": "https://packagist.org/packages/baserproject/basercms"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/baserproject/basercms/commit/b70474ef9dcee6ad8826360884625dc7ca9041a1"}], "source": {"advisory": "GHSA-wpww-4jf4-4hx8", "discovery": "UNKNOWN"}, "title": "Cross-Site Scripting in baserCMS", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-15273", "STATE": "PUBLIC", "TITLE": "Cross-Site Scripting in baserCMS"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "basercms", "version": {"version_data": [{"version_value": ">= 4.0.0, < 4.4.1"}]}}]}, "vendor_name": "baserproject"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://github.com/baserproject/basercms/security/advisories/GHSA-wpww-4jf4-4hx8", "refsource": "CONFIRM", "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-wpww-4jf4-4hx8"}, {"name": "https://packagist.org/packages/baserproject/basercms", "refsource": "MISC", "url": "https://packagist.org/packages/baserproject/basercms"}, {"name": "https://github.com/baserproject/basercms/commit/b70474ef9dcee6ad8826360884625dc7ca9041a1", "refsource": "MISC", "url": "https://github.com/baserproject/basercms/commit/b70474ef9dcee6ad8826360884625dc7ca9041a1"}]}, "source": {"advisory": "GHSA-wpww-4jf4-4hx8", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:15:19.029Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-wpww-4jf4-4hx8"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://packagist.org/packages/baserproject/basercms"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/baserproject/basercms/commit/b70474ef9dcee6ad8826360884625dc7ca9041a1"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-15273", "datePublished": "2020-10-30T19:10:16", "dateReserved": "2020-06-25T00:00:00", "dateUpdated": "2024-08-04T13:15:19.029Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:basercms:basercms:*:*:*:*:*:*:*:*", "matchCriteriaId": "BAB5F8EC-8396-41C0-8D37-10F8489CA598", "versionEndExcluding": "4.4.1", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1."}, {"lang": "es", "value": "baserCMS anterior a la versi\u00f3n 4.4.1 es vulnerable a un ataque de tipo Cross-Site Scripting. El problema afecta a los siguientes componentes: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Un JavaScript arbitrario puede ser ejecutado ingresando caracteres espec\u00edficos en la cuenta que puede acceder a la lista de categor\u00edas de funciones de carga de archivos, la lista subsite setting, la edici\u00f3n de widget area y la lista feed sobre la pantalla de administraci\u00f3n. El problema se introdujo en la versi\u00f3n 4.0.0. Est\u00e1 corregido en la versi\u00f3n 4.4.1"}], "id": "CVE-2020-15273", "lastModified": "2020-11-03T16:57:43.317", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2020-10-30T19:15:12.597", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/baserproject/basercms/commit/b70474ef9dcee6ad8826360884625dc7ca9041a1"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-wpww-4jf4-4hx8"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://packagist.org/packages/baserproject/basercms"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}