GHSA-HMQJ-GV2M-HQ55

Vulnerability from github – Published: 2023-10-26 20:47 – Updated: 2023-10-26 20:47
VLAI?
Summary
baserCMS Directory Traversal vulnerability in Form submission data management Feature
Details

There is a Directory Traversal Vulnerability in Form submission data management Feature to baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.

Target

baserCMS 4.7.8 and earlier versions

Vulnerability

There is a possibility that information on the server may be obtained by a user who is logged in to the management screen.

Countermeasures

Update to the latest version of baserCMS

Please refer to the following page to reference for more information. https://basercms.net/security/JVN_45547161

Credits

Shiga Takuma@BroadBand Security, Inc

Severity ?
4.9 (Medium)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "baserproject/basercms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-43648"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-26T20:47:57Z",
    "nvd_published_at": "2023-10-30T19:15:08Z",
    "severity": "MODERATE"
  },
  "details": "There is a Directory Traversal Vulnerability in Form submission data management Feature to baserCMS.\n\nThis is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.\nIf you are eligible, please update to the new version as soon as possible.\n\n### Target\nbaserCMS 4.7.8 and earlier versions\n\n### Vulnerability\nThere is a possibility that information on the server may be obtained by a user who is logged in to the management screen.\n\n### Countermeasures\nUpdate to the latest version of baserCMS\n\nPlease refer to the following page to reference for more information.\nhttps://basercms.net/security/JVN_45547161\n\n### Credits\nShiga Takuma@BroadBand Security, Inc\n",
  "id": "GHSA-hmqj-gv2m-hq55",
  "modified": "2023-10-26T20:47:57Z",
  "published": "2023-10-26T20:47:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/baserproject/basercms/security/advisories/GHSA-hmqj-gv2m-hq55"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43648"
    },
    {
      "type": "WEB",
      "url": "https://github.com/baserproject/basercms/commit/7555a5cf0006755dc0223fffc2d882b50a97758b"
    },
    {
      "type": "WEB",
      "url": "https://basercms.net/security/JVN_81174674"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/baserproject/basercms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "baserCMS Directory Traversal vulnerability in Form submission data management Feature"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.