Vulnerability · Published Mar 23, 2023 · Assigned by GitHub_M
CVE-2023-25654baserCMS File Uploader Remote Code Execution (RCE) vulnerability
Critical 9.8
In plain English
A critical-severity unrestricted file upload in basercms from baserproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.5%top 25.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | baserproject/basercms | 4.7.5 | GHSA-h4cc-fxpp-pgw9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| baserproject | basercms | < 4.7.4 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/baserproject/basercms/security/advisories/GHSA-h4cc-fxpp-pgw9 x_refsource_CONFIRM
- https://github.com/baserproject/basercms/commit/002886be0998c74c386e04f0b43688a8a45d7a96 x_refsource_MISC
- https://github.com/baserproject/basercms/commit/08247f0a633d8e836ce2e5cd2d53aa19901a1359 x_refsource_MISC
- https://github.com/baserproject/basercms/commit/60f83054d8131b0ace60716cec7e629b5eb3a8f0 x_refsource_MISC
- https://github.com/baserproject/basercms/releases/tag/basercms-4.7.5 x_refsource_MISC