Vulnerability · Published Nov 26, 2021 · Assigned by GitHub_M
CVE-2021-41243OS Command Injection Vulnerability and Potential Zip Slip Vulnerability
Critical 9.1
In plain English
A critical-severity OS command injection in basercms from baserproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | baserproject/basercms | 4.5.4 | GHSA-7rpc-9m88-cf9w |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| baserproject | basercms | < 4.5.4 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L