OS Command Injection Vulnerability and Potential Zip Slip Vulnerability in baserCMS

高 8.8CVE-2021-41243 · GHSA-7rpc-9m88-cf9w · 26/11/2021 公開 · 17/06/2026 更新

要点

CVE-2021-41243 は baserproject/basercms, basercms (basercms) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.2%（全脆弱性の 82.3% より高い）。
対処：4.5.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
baserproject/basercms Packagist	`< 4.5.4`	`4.5.4`
basercms basercms	`< 4.5.4`	`4.5.4`

概要

There is an OS Command Injection Vulnerability on the management system of baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.

Target baserCMS 4.5.3 and earlier versions

Vulnerability OS Command Injection Vulnerability.

Countermeasures Update to the latest version of baserCMS

Credits Akagi Yusuke @NTT-ME

NVD の説明

There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.

参考情報

baserproject/basercms security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-41243 · ADVISORY
baserproject/basercms commit 9088b99 · WEB
baserproject/basercms · PACKAGE

baserproject/basercms のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

baserproject/basercms

Packagist

< 4.5.4

4.5.4

basercms