Vulnerability · Published Oct 30, 2020 · Assigned by GitHub_M
CVE-2020-15277Remote Code Execution in baserCMS
High 7.2
In plain English
A high-severity unrestricted file upload in basercms from baserproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)2.3%top 16.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | baserproject/basercms | 4.4.1 | GHSA-6fmv-q269-55cw |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| baserproject | basercms | >= 4.0.0, < 4.4.1 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/baserproject/basercms/security/advisories/GHSA-6fmv-q269-55cw x_refsource_CONFIRM
- https://basercms.net/security/20201029 x_refsource_MISC
- https://github.com/baserproject/basercms/commit/bb027c3967b0430adcff2d2fedbc23d39077563b x_refsource_MISC